samba_spnupdate invoked oom-killer ( samba BUG )

[Volker Lendecke]

On Sat, Oct 04, 2014 at 11:50:21AM +0200, Volker Lendecke wrote:
> You might want to take a look at the attached patchset. This
> is what I've dug out of my huge messaging mess. It compiles,
> but right now I don't have the time to even do some simple
> tests. At least that's the direction where I want to go
> eventually.

... and with


source3/lib/messages.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/source3/lib/messages.c b/source3/lib/messages.c
index 94a738f..f153727 100644
--- a/source3/lib/messages.c
+++ b/source3/lib/messages.c
@@ -206,7 +206,6 @@ static void messaging_recv_cb(const uint8_t *msg, size_t msg_len,
 {
 	struct messaging_context *msg_ctx = talloc_get_type_abort(
 		private_data, struct messaging_context);
-	uint8_t hdr[MESSAGE_HDR_LENGTH];
 	uint32_t msg_type;
 	struct server_id src, dst;
 	struct server_id_buf idbuf;
@@ -214,7 +213,7 @@ static void messaging_recv_cb(const uint8_t *msg, size_t msg_len,
 	int64_t fds64[MIN(num_fds, INT8_MAX)];
 	size_t i;
 
-	if (msg_len < sizeof(*hdr)) {
+	if (msg_len < MESSAGE_HDR_LENGTH) {
 		for (i=0; i < num_fds; i++) {
 			close(fds[i]);
 		}
@@ -239,7 +238,7 @@ static void messaging_recv_cb(const uint8_t *msg, size_t msg_len,
 		fds[i] = -1;
 	}
 
-	message_hdr_get(&msg_type, &src, &dst, hdr);
+	message_hdr_get(&msg_type, &src, &dst, msg);
 
 	DEBUG(10, ("%s: Received message 0x%x len %u (num_fds:%u) from %s\n",
 		   __func__, (unsigned)msg_type,

on top it even does survive a few simple tests.

smbcontrol <samba-pid> ping

works both in standard as well as in single process model. That's what you
get if you dig up stuff from big heap of stuff... Now to run autobuild.

Volker

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt at sernet.de