Memory leaks in smbd ?

[Martin Zielinski]

Volker Lendecke wrote:
> Hi!
> 
> On Fri, Nov 14, 2008 at 09:13:18AM +0100, Martin Zielinski wrote:
> 
>> diff -urN source/auth/auth_util.c source.samu/auth/auth_util.c
>> --- source/auth/auth_util.c	2008-09-18 08:49:02.000000000 +0200
>> +++ source.samu/auth/auth_util.c	2008-11-13 09:36:06.000000000 +0100
>> @@ -1089,6 +1089,7 @@
>>  	
>>  	status = samu_set_unix( sampass, pwd );
>>  	if (!NT_STATUS_IS_OK(status)) {
>> +		TALLOC_FREE(sampass);
>>  		return status;
>>  	}
>>  
>> @@ -1217,8 +1218,10 @@
>>  	if (!NT_STATUS_IS_OK(status)) {
>>  		DEBUG(10, ("create_local_token failed: %s\n",
>>  			   nt_errstr(status)));
>> +		TALLOC_FREE(sampass);
>>  		return status;
>>  	}
>> +	TALLOC_FREE(sampass);
> 
> This is all pretty subtle, but for example that last
> TALLOC_FREE generates segfaults. Assuming you're talking
> about 3.2ff, there is a talloc_steal make_server_info_sam
> that makes sure the struct samu gets freed properly.
> 
> We could go through all of the ones you marked, but I am
> pretty certain that they are freed as part of a higher-level
> temporary talloc context.
> 
> Did you have a chance to review my memcache.c patch I sent
> yesterday? For me it works fine, I am about to commit that
> soon.
> 
> Volker
We tried to reproduce the error, which is quite complex having a printer 
  window open and polling a non-empty printer on the samba server.

With your patch, the samu struct now is only once in the smbcontrol 
output. So yes, I would say it's fixed. There are still several "Printer 
Entry" entries, that seem not to be freed, too - but that's not so much 
memory that it will become a problem.

I really had nothing to do with your memory system before, so you know 
better, if all the memory will be cared of.
But at some places, there are conditions, after which the struct is 
freed and in the next error case it is not. It's quite tricky, to find 
out if it is intended or not.

Thanks for your help,

Martin