On winbind shutdown prior to the removal of gencache_stabilize we could crash due to races

[Richard Sharpe]

On Mon, Mar 11, 2019 at 12:32 PM Jeremy Allison <jra at samba.org> wrote:
>
> On Mon, Mar 11, 2019 at 12:30:47PM -0700, Richard Sharpe wrote:
> >
> > OK, now I understand the bug fully. I was confused for a while because
> > I have been doing a lot of work with pthreads, but this is not a
> > pthreads situation, but a separate process issue.
> >
> > This code is still in v4-9-stable:
> >
> > static void terminate(bool is_parent)
> > {
> >         if (is_parent) {
> >                 /* When parent goes away we should
> >                  * remove the socket file. Not so
> >                  * when children terminate.
> >                  */
> >                 char *path = NULL;
> >
> >                 if (asprintf(&path, "%s/%s",
> >                         lp_winbindd_socket_directory(),
> > WINBINDD_SOCKET_NAME) > 0) {
> >                         unlink(path);
> >                         SAFE_FREE(path);
> >                 }
> >         }
> >
> >         idmap_close();
> >
> >         gencache_stabilize();
> >
> >         netlogon_creds_cli_close_global_db();
> >
> > If the parent exists before the children have finished their
> > gencache_stabilize scans, they will crash, because the mmap'd region
> > goes away.
> >
> > I will file a ticket.
>
> Great, thanks ! Once you've got a fix we can
> ensure it's back-ported to all supported versions.

I am still confused because the crash seems to indicate that the
mmap'd region for the mutexes is gone, but that seems like it can only
happen if gencache was initialized in the parent before any children
were created and we have real pread and pwrite in which case we skip
the reopen.

Also, these code paths seem to have changed in 4.8.

So, I will do some more digging and see if I can find a way to make
this occur more reliably.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)(传说杜康是酒的发明者)