[PATCH] Fix bug #11375 - ordering issue in teardown in server exit.

[Stefan Metzmacher]

Hi Jeremy,

> On Tue, Nov 24, 2015 at 10:09:39PM +0100, Stefan Metzmacher wrote:
>> smbXsrv_session_logoff() sets session->table = NULL;
>> and should exit immediately the 2nd time.
>> Am I missing something?
>>
>> This can only explained if it's NOT called twice,
>> but the first time AFTER sconn is already gone.
> 
> Yes, you're right. It must be the first call
> after sconn is deleted.
> 
>> A wild guess, could we have a bug in dbwrap_rbt traverse?
>> That may skip entries randomly?
> 
> That's a tricky recursive function. Maybe.
> I'll take a close look....

I added some tests. I started to write this mail
saying it all works, but I just got this:

And the failure reproduces very often, but
valgrind doesn't give errors.

I'd guess it's related to __rb_rotate_right and __rb_rotate_left
and our traverse code doesn't have this in mind.
I'm wondering if we need to somehow make use of rb_next(), rb_prev(),
rb_first() and rb_last().

$ valgrind bin/smbtorture3 //somehost/share -U% LOCAL-RBTREE
==32652== Memcheck, a memory error detector
==32652== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==32652== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for
copyright info
==32652== Command: bin/smbtorture3 //somehost/share -U% LOCAL-RBTREE
==32652==
using seed 1448433994
host=somehost share=share user= myname=SERNOX14
Running LOCAL-RBTREE
run_local_rbtree: read1: 1000 1000, NT_STATUS_OK
run_local_rbtree: delete: 780 780, NT_STATUS_OK
run_local_rbtree: read2: 220 220, NT_STATUS_OK
LOCAL-RBTREE took 0,215545 secs

==32652==
==32652== HEAP SUMMARY:
==32652==     in use at exit: 63,635 bytes in 109 blocks
==32652==   total heap usage: 11,491 allocs, 11,382 frees, 1,402,364
bytes allocated
==32652==
==32652== LEAK SUMMARY:
==32652==    definitely lost: 0 bytes in 0 blocks
==32652==    indirectly lost: 0 bytes in 0 blocks
==32652==      possibly lost: 54,489 bytes in 87 blocks
==32652==    still reachable: 9,146 bytes in 22 blocks
==32652==         suppressed: 0 bytes in 0 blocks
==32652== Rerun with --leak-check=full to see details of leaked memory
==32652==
==32652== For counts of detected and suppressed errors, rerun with: -v
==32652== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

-------------- next part --------------
From d9b204c7cdf6d6875612aeb33e2905253bcf0751 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze at samba.org>
Date: Wed, 25 Nov 2015 00:13:17 +0100
Subject: [PATCH] s3:torture: add traverse testing to LOCAL-RBTREE

Signed-off-by: Stefan Metzmacher <metze at samba.org>
---
 source3/torture/torture.c | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index ef75d214..6c34e4c 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -8347,11 +8347,29 @@ static bool rbt_testval(struct db_context *db, const char *key,
 	return ret;
 }
 
+static int local_rbtree_traverse_read(struct db_record *rec, void *private_data)
+{
+	int *count2 = (int *)private_data;
+	(*count2)++;
+	return 0;
+}
+
+static int local_rbtree_traverse_delete(struct db_record *rec, void *private_data)
+{
+	int *count2 = (int *)private_data;
+	(*count2)++;
+	dbwrap_record_delete(rec);
+	return 0;
+}
+
 static bool run_local_rbtree(int dummy)
 {
 	struct db_context *db;
 	bool ret = false;
 	int i;
+	NTSTATUS status;
+	int count = 0;
+	int count2 = 0;
 
 	db = db_open_rbt(NULL);
 
@@ -8394,6 +8412,27 @@ static bool run_local_rbtree(int dummy)
 	}
 
 	ret = true;
+	count = 0; count2 = 0;
+	status = dbwrap_traverse_read(db, local_rbtree_traverse_read,
+				      &count2, &count);
+	printf("%s: read1: %d %d, %s\n", __func__, count, count2, nt_errstr(status));
+	if ((count != count2) || (count != 1000)) {
+		ret = false;
+	}
+	count = 0; count2 = 0;
+	status = dbwrap_traverse(db, local_rbtree_traverse_delete,
+				 &count2, &count);
+	printf("%s: delete: %d %d, %s\n", __func__, count, count2, nt_errstr(status));
+	if ((count != count2) || (count != 1000)) {
+		ret = false;
+	}
+	count = 0; count2 = 0;
+	status = dbwrap_traverse_read(db, local_rbtree_traverse_read,
+				      &count2, &count);
+	printf("%s: read2: %d %d, %s\n", __func__, count, count2, nt_errstr(status));
+	if ((count != count2) || (count != 0)) {
+		ret = false;
+	}
 
  done:
 	TALLOC_FREE(db);
-- 
1.9.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20151125/0ca66b2f/signature.sig>