[Samba] continuous access to printer causes high memory usage

[Jeremy Allison]

On Tue, Jul 25, 2006 at 02:24:27PM -0700, Jeremy Allison wrote:
> On Tue, Jul 25, 2006 at 05:54:47PM +0200, Roel van Meer wrote:
> > Martin Zielinski writes:
> > 
> > >and http://lists.samba.org/archive/samba/2004-November/096492.html
> > >The symptoms are the same as you described.
> > 
> > This seems to be exactly what is biting us. I've tried to get a 
> > configuration on the client that would not result in the spooler to go into 
> > a loop, but no success so far.
> > 
> > As an afterthought, why should a repeated access from a spooler result in 
> > unlimited memory consumption of the smbd process? It seems odd.
> > 
> > The output of 'smbcontrol <pid> pool-usage' on the memory-using smbd 
> > processes shows that thare are many references to a structure named 
> > NT_PRINTER_INFO_LEVEL (many thousands, increasing with about 230 every 
> > minute) that keep the memory allocated. This causes the used virtual memory 
> > to increase with about 4 MiB per minute.
> > 
> > Is this something that is in fact correct behaviour but is leading to too 
> > much memory consumption because of the amount of rpc calls?
> > 
> > As there are more people who seem to have this problem I've opened a 
> > bugzilla report: https://bugzilla.samba.org/show_bug.cgi?id=3962
> 
> Please try this patch I've just committed (and attached to
> the 3962 bug). I think it may fix the problem.

Actually, you'll need this one as well (stops double free in infolevel 2
case).

Jeremy.
-------------- next part --------------
Index: rpc_server/srv_spoolss_nt.c
===================================================================
--- rpc_server/srv_spoolss_nt.c	(revision 17244)
+++ rpc_server/srv_spoolss_nt.c	(working copy)
@@ -6395,9 +6395,9 @@
 /****************************************************************************
 ****************************************************************************/
 
-static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
+static void fill_job_info_1(JOB_INFO_1 *job_info, const print_queue_struct *queue,
                             int position, int snum, 
-                            NT_PRINTER_INFO_LEVEL *ntprinter)
+                            const NT_PRINTER_INFO_LEVEL *ntprinter)
 {
 	struct tm *t;
 	
@@ -6422,9 +6422,9 @@
 /****************************************************************************
 ****************************************************************************/
 
-static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
+static BOOL fill_job_info_2(JOB_INFO_2 *job_info, const print_queue_struct *queue,
                             int position, int snum, 
-			    NT_PRINTER_INFO_LEVEL *ntprinter,
+			    const NT_PRINTER_INFO_LEVEL *ntprinter,
 			    DEVICEMODE *devmode)
 {
 	struct tm *t;
@@ -6467,8 +6467,8 @@
  Enumjobs at level 1.
 ****************************************************************************/
 
-static WERROR enumjobs_level1(print_queue_struct *queue, int snum,
-                              NT_PRINTER_INFO_LEVEL *ntprinter,
+static WERROR enumjobs_level1(const print_queue_struct *queue, int snum,
+                              const NT_PRINTER_INFO_LEVEL *ntprinter,
 			      RPC_BUFFER *buffer, uint32 offered,
 			      uint32 *needed, uint32 *returned)
 {
@@ -6478,7 +6478,6 @@
 	
 	info=SMB_MALLOC_ARRAY(JOB_INFO_1,*returned);
 	if (info==NULL) {
-		SAFE_FREE(queue);
 		*returned=0;
 		return WERR_NOMEM;
 	}
@@ -6486,8 +6485,6 @@
 	for (i=0; i<*returned; i++)
 		fill_job_info_1( &info[i], &queue[i], i, snum, ntprinter );
 
-	SAFE_FREE(queue);
-
 	/* check the required size. */	
 	for (i=0; i<*returned; i++)
 		(*needed) += spoolss_size_job_info_1(&info[i]);
@@ -6520,8 +6517,8 @@
  Enumjobs at level 2.
 ****************************************************************************/
 
-static WERROR enumjobs_level2(print_queue_struct *queue, int snum,
-                              NT_PRINTER_INFO_LEVEL *ntprinter,
+static WERROR enumjobs_level2(const print_queue_struct *queue, int snum,
+                              const NT_PRINTER_INFO_LEVEL *ntprinter,
 			      RPC_BUFFER *buffer, uint32 offered,
 			      uint32 *needed, uint32 *returned)
 {
@@ -6542,9 +6539,6 @@
 	for (i=0; i<*returned; i++)
 		fill_job_info_2(&(info[i]), &queue[i], i, snum, ntprinter, devmode);
 
-	free_a_printer(&ntprinter, 2);
-	SAFE_FREE(queue);
-
 	/* check the required size. */	
 	for (i=0; i<*returned; i++)
 		(*needed) += spoolss_size_job_info_2(&info[i]);