[PATCH] Fix smbd crash (valgrind error) if generic memcache evicts share mode entry. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13871

[Jeremy Allison]

On Sat, Mar 30, 2019 at 07:22:36PM -0700, Jeremy Allison via samba-technical wrote:
> On Sat, Mar 30, 2019 at 04:48:19PM -0700, Jeremy Allison via samba-technical wrote:
> > On Sat, Mar 30, 2019 at 05:07:01PM +0100, Ralph Böhme wrote:
> > > Can you please share the exact steps how to reproduce the isue? Thanks!
> > 
> > Apply the patch from:
> > 
> > https://bugzilla.samba.org/show_bug.cgi?id=13865
> > 
> > (this patch).
> > 
> > https://attachments.samba.org/attachment.cgi?id=15021
> > 
> > make, then do:
> > 
> > $ make test TESTS=samba3.base.rw1
> > 
> > and you'll get a reliable smbd crash.
> 
> Aha. Did some more digging....
> 
> Looks like the patch in:
> 
> https://bugzilla.samba.org/show_bug.cgi?id=13865
> https://attachments.samba.org/attachment.cgi?id=15021
> 
> buggers up the memcache sizes, so we try and remove
> the entry we're actually adding.
> 
> Sorry for the noise :-). Please ignore bug
> 
> https://bugzilla.samba.org/show_bug.cgi?id=13871
> 
> until I've dug into this some more.

Yep. Confirmed:

https://bugzilla.samba.org/show_bug.cgi?id=13871

gives a -ve (unsigned) cache length, which causes
all memcache entries to be removed, including the
one we're currently adding (FYI, there should be
memcache logic that prevents trim from removing
the entry just added, even if it's over the cache
size - but that's a bug for another day :-).

That causes the crash and the valgrind error seen.

Sorry for the error. Please ignore this thread (and
I've closed bug https://bugzilla.samba.org/show_bug.cgi?id=13871
as INVALID). I'll concentrate on the memcache code with
cs.