1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
samba-mirror/source3/winbindd
Volker Lendecke 68c5c6df0e Fix a race condition in winbind leading to a panic
In winbind, we do multiple events in one select round. This needs fixing, but
as long as we're still using it, for efficiency reasons we need to do that.

What can happen is the following: We have outgoing data pending for a client,
thus

	state->fd_event.flags == EVENT_FD_WRITE

Now a new client comes in, we go through the list of clients to find an idle
one. The detection for idle clients in remove_idle_client does not take the
pending data into account. We close the socket that has pending outgoing data,
the accept(2) one syscall later gives us the same socket.

In new_connection(), we do a setup_async_read, setting up a read fde. The
select from before however had found the socket (that we had already closed!!)
to be writable. In rw_callback we only want to see a readable flag, and we
panic in the SMB_ASSERT(flags == EVENT_FD_READ).

Found using

bin/smbtorture //127.0.0.1/tmp -U% -N 500 -o 2 local-wbclient

Volker
2009-05-24 18:57:13 +02:00
..
idmap_adex s3-libads: avoid NULL talloc context with ads_get_dn(). 2009-04-07 01:17:30 +02:00
idmap_hash More fix to initialize idmap statuses 2009-03-02 15:51:55 -08:00
idmap_ad.c More fix to initialize idmap statuses 2009-03-02 15:51:55 -08:00
idmap_ldap.c s3:winbind:idmap_ldap: fix a crash bug in idmap_ldap_unixids_to_sids (#6387) 2009-05-22 12:06:59 +02:00
idmap_nss.c More fix to initialize idmap statuses 2009-03-02 15:51:55 -08:00
idmap_passdb.c idmap rewrite 2008-08-12 11:28:29 +02:00
idmap_rid.c More fix to initialize idmap statuses 2009-03-02 15:51:55 -08:00
idmap_tdb2.c More fix to initialize idmap statuses 2009-03-02 15:51:55 -08:00
idmap_tdb.c More fix to initialize idmap statuses 2009-03-02 15:51:55 -08:00
idmap_util.c Fix a typo 2009-05-16 19:22:03 +02:00
idmap.c s3-idmap: Fix bug #6286: Call init function for builtin idmap modules before probing for them as shared modules. 2009-04-24 10:02:06 +02:00
nss_info_template.c s3:winbindd/nss_info: change nss_map_{to|from}_alias to take nss_domain_entry 2008-12-01 04:37:20 +01:00
nss_info.c s3:winbindd/nss_info: remove unused variable from nss_init() 2008-12-01 04:37:24 +01:00
winbindd_ads.c s3:libads Make ads_get_dn() take a talloc context 2009-04-06 15:54:41 +02:00
winbindd_async.c Convert response.extra_data.data from malloc to talloc 2009-05-12 18:02:00 +02:00
winbindd_cache.c Fix a bunch of compiler warnings about wrong format types. 2009-05-11 21:56:57 -07:00
winbindd_ccache_access.c Convert response.extra_data.data from malloc to talloc 2009-05-12 18:02:00 +02:00
winbindd_cm.c Fix some type-punned warnings 2009-05-07 23:38:48 +02:00
winbindd_cred_cache.c Rework Samba3 to use new libcli/auth code (partial) 2009-04-14 16:23:35 +10:00
winbindd_creds.c Rework Samba3 to use new libcli/auth code (partial) 2009-04-14 16:23:35 +10:00
winbindd_domain.c s3: Implement wbcGetSidAliases 2009-02-11 19:39:18 -08:00
winbindd_dual.c s3: Fix onlinestatus msg to return status of all domain instead of omitting trusted domains 2009-05-22 02:12:59 +08:00
winbindd_group.c Convert response.extra_data.data from malloc to talloc 2009-05-12 18:02:00 +02:00
winbindd_idmap.c Fix a bunch of compiler warnings about wrong format types. 2009-05-11 21:56:57 -07:00
winbindd_locator.c s3-winbindd: use new, richer structures in WINBINDD_DSGETDCNAME implementation. 2008-10-09 12:37:18 +02:00
winbindd_misc.c Convert response.extra_data.data from malloc to talloc 2009-05-12 18:02:00 +02:00
winbindd_ndr.c Split the winbindd_passdb backend into a 'builtin' and a 'sam' 2008-05-30 23:49:36 -07:00
winbindd_pam.c Convert response.extra_data.data from malloc to talloc 2009-05-12 18:02:00 +02:00
winbindd_passdb.c Shape up pdb_search a bit by making it a talloc ctx with a destructor 2009-03-07 17:51:21 +01:00
winbindd_proto.h s3: remove POLICY_HND. 2009-03-18 23:22:29 +01:00
winbindd_reconnect.c Use rpccli_samr_QueryDomainInfo() in winbindd. 2008-02-06 02:09:44 +01:00
winbindd_rpc.c s3-secdesc: use SEC_FLAG_MAXIMUM_ALLOWED instead of SEC_RIGHTS_MAXIMUM_ALLOWED. 2009-04-21 12:40:47 +02:00
winbindd_sid.c Clean-up various trailing space and >80 column lines. 2008-11-18 17:06:22 -08:00
winbindd_user.c Convert response.extra_data.data from malloc to talloc 2009-05-12 18:02:00 +02:00
winbindd_util.c Fix some nonempty blank lines 2009-05-11 23:08:30 +02:00
winbindd_wins.c Fix some type-punned warnings 2009-05-07 23:38:48 +02:00
winbindd.c Fix a race condition in winbind leading to a panic 2009-05-24 18:57:13 +02:00
winbindd.h s3: remove POLICY_HND. 2009-03-18 23:22:29 +01:00