build:wafsamba: removed most import * statements by ita1024 · Pull Request #29 · samba-team/samba

ita1024 · 2015-10-27T19:52:10Z

The 'import *' statements make it more difficult to reason about
the modules and tends to conceal bugs. These changes enable running
Pyflakes against most of the Samba build scripts. A few misleading
unused variables have been removed in the process.

Signed-off-by: Thomas Nagy tnagy@waf.io

The 'import *' statements make it more difficult to reason about the modules and tends to conceal bugs. These changes enable running pyflakes against most of the build scripts. Signed-off-by: Thomas Nagy <tnagy@waf.io>

abartlet · 2015-10-27T22:19:59Z

Reviewed-by: Andrew Bartlett abartlet@samba.org

obnoxxx · 2015-10-28T19:44:55Z

This has been merged upstream.

abartlet · 2015-10-28T21:05:49Z

Merged as 2666d06

The change for https://bugzilla.samba.org/show_bug.cgi?id=7587 ("talloc_autofree_context() in shared libraries and plugins is a bad idea on FreeBSD") (ommit 41b6810) causes the following for sssd on Linux: Stack trace of thread 19667: #0 0x00007f2cab91ff6b __GI_raise (libc.so.6) #1 0x00007f2cab90a5c1 __GI_abort (libc.so.6) #2 0x00007f2cab90a491 __assert_fail_base (libc.so.6) #3 0x00007f2cab9186e2 __GI___assert_fail (libc.so.6) #4 0x00007f2cb10aaca5 k5_mutex_lock (libkrb5.so.3) #5 0x00007f2cb10ab790 k5_mutex_lock (libkrb5.so.3) #6 0x00007f2cb10ab8f5 profile_free_file (libkrb5.so.3) #7 0x00007f2cb10ab983 profile_close_file (libkrb5.so.3) #8 0x00007f2cb10af249 profile_release (libkrb5.so.3) #9 0x00007f2cb10a06c7 k5_os_free_context (libkrb5.so.3) #10 0x00007f2cb1075a9a krb5_free_context (libkrb5.so.3) #11 0x000055cea7cb2dd1 kcm_data_destructor (sssd_kcm) #12 0x00007f2cac153e96 _tc_free_internal (libtalloc.so.2) #13 0x00007f2cac1537b0 _tc_free_internal (libtalloc.so.2) #14 0x00007f2cac1537b0 _tc_free_internal (libtalloc.so.2) #15 0x00007f2cac1537b0 _tc_free_internal (libtalloc.so.2) #16 0x00007f2cac1537b0 _tc_free_internal (libtalloc.so.2) #17 0x00007f2cac14e648 _talloc_free (libtalloc.so.2) #18 0x00007f2cac14c480 talloc_lib_fini (libtalloc.so.2) #19 0x00007f2cb151da96 _dl_fini (ld-linux-x86-64.so.2) #20 0x00007f2cab9226bc __run_exit_handlers (libc.so.6) #21 0x00007f2cab9227ec __GI_exit (libc.so.6) #22 0x00007f2cb030dc61 orderly_shutdown (libsss_util.so) #23 0x00007f2cac365a46 tevent_common_check_signal (libtevent.so.0) #24 0x00007f2cac367975 epoll_event_loop_once (libtevent.so.0) #25 0x00007f2cac365dab std_event_loop_once (libtevent.so.0) #26 0x00007f2cac362098 _tevent_loop_once (libtevent.so.0) #27 0x00007f2cac3622eb tevent_common_loop_wait (libtevent.so.0) #28 0x00007f2cac365d3b std_event_loop_wait (libtevent.so.0) #29 0x00007f2cb030eb37 server_loop (libsss_util.so) #30 0x000055cea7cb29f4 main (sssd_kcm) #31 0x00007f2cab90c1eb __libc_start_main (libc.so.6) #32 0x000055cea7cb2c7a _start (sssd_kcm) We still only register one atexit handler instead of multiple ones like in talloc 2.1.11, but avoids using a library destructor. Bug #7587 seems to be fixed by not using talloc_autofree_context() within samba. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13366 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>

…ba:debian/dvm6 to debian/dvm6 Merging Samba svt6 * commit '6a380f9eb7efb1ab4cdd59eed215f38ca52a0c90': CHangelog for svt6 samba HYP-4444: Remove svt-samba-init from debian package. patches for svt6 samba

…do_locked() As reported on samba-technical by Rouven WEILER <Rouven_Weiler@gmx.net>: https://lists.samba.org/archive/samba-technical/2020-April/135116.html Following backtrace was observed with vfs_fruit for time machine backup: [2020/04/10 08:00:38.107917, 0] ../../lib/dbwrap/dbwrap.c:82(dbwrap_record_get_value) PANIC: assert failed at ../../lib/dbwrap/dbwrap.c(82): rec->value_valid [2020/04/10 08:00:38.108499, 0] ../../source3/lib/util.c:830(smb_panic_s3) PANIC (pid 3427): assert failed: rec->value_valid [2020/04/10 08:00:38.109541, 0] ../../lib/util/fault.c:265(log_stack_trace) BACKTRACE: 37 stack frames: #0 /usr/lib/samba/amd64/libsamba-util.so.0.0.1'log_stack_trace+0x26 [0xfffffd7fee51de66] #1 /usr/lib/samba/amd64/libsmbconf.so.0'smb_panic_s3+0x26 [0xfffffd7fedf5a596] #2 /usr/lib/samba/amd64/libsamba-util.so.0.0.1'smb_panic+0x1f [0xfffffd7fee51df3f] #3 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'dbwrap_record_get_value+0x2a [0xfffffd7feccb627a] #4 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'get_share_mode_lock+0x109 [0xfffffd7fee7195c9] #5 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_contend_level2_oplocks_begin+0xa1 [0xfffffd7fee7f7761] #6 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'brl_lock+0x635 [0xfffffd7fee710f45] #7 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'do_lock_fn+0xa4 [0xfffffd7fee70d534] #8 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'share_mode_do_locked_fn+0x86 [0xfffffd7fee7174b6] #9 /usr/lib/samba/amd64/libsmbconf.so.0'dbwrap_watched_do_locked_fn+0xfa [0xfffffd7fedf622ca] #10 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'db_tdb_do_locked+0x12f [0xfffffd7feccb95cf] #11 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'dbwrap_do_locked+0x48 [0xfffffd7feccb69a8] #12 /usr/lib/samba/amd64/libsmbconf.so.0'dbwrap_watched_do_locked+0x6f [0xfffffd7fedf60d7f] #13 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'dbwrap_do_locked+0x48 [0xfffffd7feccb69a8] #14 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'share_mode_do_locked+0xd2 [0xfffffd7fee719b82] #15 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'do_lock+0xf0 [0xfffffd7fee70dfe0] #16 /usr/lib/samba/amd64/vfs/fruit.so'fruit_create_file+0x7ba [0xfffffd7fe88855aa] #17 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_smb2_request_process_create+0xa07 [0xfffffd7fee7d3237] #18 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_smb2_request_dispatch+0xc8f [0xfffffd7fee7c985f] #19 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_smb2_connection_handler+0x621 [0xfffffd7fee7ca7e1] #20 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_invoke_fd_handler+0x80 [0xfffffd7fecd3a580] #21 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'epoll_event_loop_once+0x22c [0xfffffd7fecd4180c] #22 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_once+0x40 [0xfffffd7fecd3f8f0] #23 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'_tevent_loop_once+0x95 [0xfffffd7fecd39bd5] #24 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_loop_wait+0x23 [0xfffffd7fecd39e43] #25 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_wait+0x40 [0xfffffd7fecd3f870] #26 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_process+0x777 [0xfffffd7fee7b8677] #27 /usr/lib/samba/sbin/amd64/smbd'smbd_accept_connection+0x189 [0x40d5b9] #28 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_invoke_fd_handler+0x80 [0xfffffd7fecd3a580] #29 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'epoll_event_loop_once+0x22c [0xfffffd7fecd4180c] #30 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_once+0x40 [0xfffffd7fecd3f8f0] #31 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'_tevent_loop_once+0x95 [0xfffffd7fecd39bd5] #32 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_loop_wait+0x23 [0xfffffd7fecd39e43] #33 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_wait+0x40 [0xfffffd7fecd3f870] #34 /usr/lib/samba/sbin/amd64/smbd'main+0x1a0f [0x40f9ff] #35 /usr/lib/samba/sbin/amd64/smbd'_start_crt+0x83 [0x408e73] #36 /usr/lib/samba/sbin/amd64/smbd'_start+0x18 [0x408dd8] In this particular nested share_mode_do_locked() invocation, callback comes through dbwrap_watched_do_locked_fn() where it fails to update rec->value_valid which further gets assigned to static_share_mode_record within share_mode_do_locked_fn(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14352 Signed-off-by: Anoop C S <anoopcs@redhat.com> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Tue Apr 21 17:37:43 UTC 2020 on sn-devel-184

…do_locked() As reported on samba-technical by Rouven WEILER <Rouven_Weiler@gmx.net>: https://lists.samba.org/archive/samba-technical/2020-April/135116.html Following backtrace was observed with vfs_fruit for time machine backup: [2020/04/10 08:00:38.107917, 0] ../../lib/dbwrap/dbwrap.c:82(dbwrap_record_get_value) PANIC: assert failed at ../../lib/dbwrap/dbwrap.c(82): rec->value_valid [2020/04/10 08:00:38.108499, 0] ../../source3/lib/util.c:830(smb_panic_s3) PANIC (pid 3427): assert failed: rec->value_valid [2020/04/10 08:00:38.109541, 0] ../../lib/util/fault.c:265(log_stack_trace) BACKTRACE: 37 stack frames: #0 /usr/lib/samba/amd64/libsamba-util.so.0.0.1'log_stack_trace+0x26 [0xfffffd7fee51de66] #1 /usr/lib/samba/amd64/libsmbconf.so.0'smb_panic_s3+0x26 [0xfffffd7fedf5a596] #2 /usr/lib/samba/amd64/libsamba-util.so.0.0.1'smb_panic+0x1f [0xfffffd7fee51df3f] #3 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'dbwrap_record_get_value+0x2a [0xfffffd7feccb627a] #4 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'get_share_mode_lock+0x109 [0xfffffd7fee7195c9] #5 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_contend_level2_oplocks_begin+0xa1 [0xfffffd7fee7f7761] #6 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'brl_lock+0x635 [0xfffffd7fee710f45] #7 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'do_lock_fn+0xa4 [0xfffffd7fee70d534] #8 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'share_mode_do_locked_fn+0x86 [0xfffffd7fee7174b6] #9 /usr/lib/samba/amd64/libsmbconf.so.0'dbwrap_watched_do_locked_fn+0xfa [0xfffffd7fedf622ca] #10 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'db_tdb_do_locked+0x12f [0xfffffd7feccb95cf] #11 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'dbwrap_do_locked+0x48 [0xfffffd7feccb69a8] #12 /usr/lib/samba/amd64/libsmbconf.so.0'dbwrap_watched_do_locked+0x6f [0xfffffd7fedf60d7f] #13 /usr/lib/samba/private/amd64/libdbwrap-samba4.so'dbwrap_do_locked+0x48 [0xfffffd7feccb69a8] #14 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'share_mode_do_locked+0xd2 [0xfffffd7fee719b82] #15 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'do_lock+0xf0 [0xfffffd7fee70dfe0] #16 /usr/lib/samba/amd64/vfs/fruit.so'fruit_create_file+0x7ba [0xfffffd7fe88855aa] #17 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_smb2_request_process_create+0xa07 [0xfffffd7fee7d3237] #18 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_smb2_request_dispatch+0xc8f [0xfffffd7fee7c985f] #19 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_smb2_connection_handler+0x621 [0xfffffd7fee7ca7e1] #20 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_invoke_fd_handler+0x80 [0xfffffd7fecd3a580] #21 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'epoll_event_loop_once+0x22c [0xfffffd7fecd4180c] #22 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_once+0x40 [0xfffffd7fecd3f8f0] #23 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'_tevent_loop_once+0x95 [0xfffffd7fecd39bd5] #24 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_loop_wait+0x23 [0xfffffd7fecd39e43] #25 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_wait+0x40 [0xfffffd7fecd3f870] #26 /usr/lib/samba/private/amd64/libsmbd-base-samba4.so'smbd_process+0x777 [0xfffffd7fee7b8677] #27 /usr/lib/samba/sbin/amd64/smbd'smbd_accept_connection+0x189 [0x40d5b9] #28 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_invoke_fd_handler+0x80 [0xfffffd7fecd3a580] #29 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'epoll_event_loop_once+0x22c [0xfffffd7fecd4180c] #30 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_once+0x40 [0xfffffd7fecd3f8f0] #31 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'_tevent_loop_once+0x95 [0xfffffd7fecd39bd5] #32 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'tevent_common_loop_wait+0x23 [0xfffffd7fecd39e43] #33 /usr/lib/samba/private/amd64/libtevent.so.0.10.2'std_event_loop_wait+0x40 [0xfffffd7fecd3f870] #34 /usr/lib/samba/sbin/amd64/smbd'main+0x1a0f [0x40f9ff] #35 /usr/lib/samba/sbin/amd64/smbd'_start_crt+0x83 [0x408e73] #36 /usr/lib/samba/sbin/amd64/smbd'_start+0x18 [0x408dd8] In this particular nested share_mode_do_locked() invocation, callback comes through dbwrap_watched_do_locked_fn() where it fails to update rec->value_valid which further gets assigned to static_share_mode_record within share_mode_do_locked_fn(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14352 Signed-off-by: Anoop C S <anoopcs@redhat.com> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Tue Apr 21 17:37:43 UTC 2020 on sn-devel-184 (cherry picked from commit 5651faf)

…] share #0 0x00007fb264e75bea in __GI___wait4 (pid=21966, stat_loc=stat_loc@entry=0x7ffdf83a9bc8, options=options@entry=0, usage=usage@entry=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:30 sc_ret = -512 sc_ret = <optimized out> #1 0x00007fb264e75bab in __GI___waitpid (pid=<optimized out>, stat_loc=stat_loc@entry=0x7ffdf83a9bc8, options=options@entry=0) at waitpid.c:38 No locals. #2 0x00007fb264df33a3 in do_system (line=<optimized out>) at ../sysdeps/posix/system.c:172 __result = <optimized out> _buffer = { __routine = 0x7fb264df35d0 <cancel_handler>, __arg = 0x7ffdf83a9bd0, __canceltype = 0, __prev = 0x0 } _avail = 1 cancel_args = { quit = 0x7fb264f6f200 <quit>, intr = 0x7fb264f6f2a0 <intr>, pid = 21966 } status = -1 ret = 0 pid = 21966 sa = { __sigaction_handler = { sa_handler = 0x1, sa_sigaction = 0x1 }, sa_mask = { __val = {[0] = 65536, [1] = 94088581545700, [2] = 0, [3] = 0, [4] = 0, [5] = 0, [6] = 0, [7] = 1703897678, [8] = 140404174928432, [9] = 140404179009536, [10] = 0, [11] = 140728768044480, [12] = 140404185491504, [13] = 18446744073709551615, [14] = 100, [15] = 140404180125856} }, sa_flags = 0, sa_restorer = 0x7ffdf83a9df0 } omask = { __val = {[0] = 7296, [1] = 140404179695051, [2] = 94088578316976, [3] = 140404180018176, [4] = 140404180017664, [5] = 140404185449449, [6] = 140728768044176, [7] = 140404185448599, [8] = 140404185458050, [9] = 100, [10] = 140404180125856, [11] = 7322926704, [12] = 140728768044432, [13] = 140404185491192, [14] = 112, [15] = 100} } reset = { __val = {[0] = 6, [1] = 5372865792, [2] = 94088581545600, [3] = 140728768044624, [4] = 100, [5] = 100, [6] = 101, [7] = 94088581545600, [8] = 140728768044288, [9] = 140404173470464, [10] = 140406703357952, [11] = 94088581545600, [12] = 94088581545600, [13] = 94088581545600, [14] = 94088581545600, [15] = 94088581545700} } spawn_attr = { __flags = 12, __pgrp = 0, __sd = { __val = {[0] = 6, [1] = 5372865792, [2] = 94088581545600, [3] = 140728768044624, [4] = 100, [5] = 100, [6] = 101, [7] = 94088581545600, [8] = 140728768044288, [9] = 140404173470464, [10] = 140406703357952, [11] = 94088581545600, [12] = 94088581545600, [13] = 94088581545600, [14] = 94088581545600, [15] = 94088581545700} }, __ss = { __val = {[0] = 7296, [1] = 140404179695051, [2] = 94088578316976, [3] = 140404180018176, [4] = 140404180017664, [5] = 140404185449449, [6] = 140728768044176, [7] = 140404185448599, [8] = 140404185458050, [9] = 100, [10] = 140404180125856, [11] = 7322926704, [12] = 140728768044432, [13] = 140404185491192, [14] = 112, [15] = 100} }, __sp = { sched_priority = 0 }, __policy = 0, __pad = {[0] = 0 <repeats 16 times>} } #3 0x00007fb2654289f6 in smb_panic_s3 (why=0x7ffdf83a9fd0 "Signal 11: Segmentation fault") at ../../source3/lib/util.c:839 lp_sub = 0x7fb265461a60 <s3_global_substitution> cmd = 0x5592b47afe30 "/home/asn/workspace/projects/samba/selftest/gdb_backtrace 21964" result = 32690 __FUNCTION__ = "smb_panic_s3" #4 0x00007fb2658f6f09 in smb_panic (why=0x7ffdf83a9fd0 "Signal 11: Segmentation fault") at ../../lib/util/fault.c:197 No locals. #5 0x00007fb2658f6a39 in fault_report (sig=11) at ../../lib/util/fault.c:81 counter = 1 signal_string = "Signal 11: Segmentation fault\000\000\000\000\240:\370\375\177\000\000\000m?@/\214؊\377\245:\370\375\177\000\000\000m?@/\214؊\000\242:\370\375\177", '\000' <repeats 11 times>, "\242:\370\375\177\000\000\351C\231e\262\177\000\000`\240:\370\375\177\000\000\002:\231e\262\177\000\000Р:\370\375\177\000\000\a\000\000\000\061\000\000" #6 0x00007fb2658f6a4e in sig_fault (sig=11) at ../../lib/util/fault.c:92 No locals. #7 <signal handler called> No locals. #8 0x00007fb2653762b4 in copy_service (pserviceDest=0x5592b4657940, pserviceSource=0x0, pcopymapDest=0x0) at ../../lib/param/loadparm.c:896 src_ptr = 0x1 dest_ptr = 0x5592b4657941 i = 1 bcopyall = true data = 0x5592b44a9020 #9 0x00007fb2653e1e16 in add_a_service (pservice=0x0, name=0x5592b4476130 "laserjet1102w") at ../../source3/param/loadparm.c:1486 i = 13 tsp = 0x5592b44a9020 __FUNCTION__ = "add_a_service" #10 0x00007fb2653e2846 in lp_add_printer (pszPrintername=0x5592b4476130 "laserjet1102w", iDefaultService=-1) at ../../source3/param/loadparm.c:1666 comment = 0x7fb2654339ec "From Printcap" i = 21906 __FUNCTION__ = "lp_add_printer" #11 0x00007fb2653e59b8 in lp_add_one_printer (name=0x5592b4476130 "laserjet1102w", comment=0x5592b512d5a0 "HP LaserJet Professional p 1102w, hpcups 3.19.6, requires proprietary plugin", location=0x5592b4476200 "", pdata=0x0) at ../../source3/param/loadparm.c:2988 printers = -1 i = 1700139171 #12 0x00007fb26556112f in printer_list_exec_fn (rec=0x7ffdf83aa7e0, private_data=0x7ffdf83aa9f0) at ../../source3/printing/printer_list.c:446 state = 0x7ffdf83aa9f0 time_h = 0 time_l = 17286 name = 0x5592b4476130 "laserjet1102w" comment = 0x5592b512d5a0 "HP LaserJet Professional p 1102w, hpcups 3.19.6, requires proprietary plugin" location = 0x5592b4476200 "" ret = 100 key = { dptr = 0x5592b456fdd0 "PRINTERLIST/PRN/LASERJET1102W", dsize = 30 } value = { dptr = 0x5592b456fdee "", dsize = 100 } __FUNCTION__ = "printer_list_exec_fn" #13 0x00007fb2646fc747 in db_tdb_traverse_read_func (tdb=0x5592b5377090, kbuf=..., dbuf=..., private_data=0x7ffdf83aa920) at ../../lib/dbwrap/dbwrap_tdb.c:399 ctx = 0x7ffdf83aa920 rec = { db = 0x5592b4957500, key = { dptr = 0x5592b456fdd0 "PRINTERLIST/PRN/LASERJET1102W", dsize = 30 }, value = { dptr = 0x5592b456fdee "", dsize = 100 }, value_valid = true, storev = 0x7fb2646fc672 <db_tdb_storev_deny>, delete_rec = 0x7fb2646fc68b <db_tdb_delete_deny>, private_data = 0x5592b5249b50 } #14 0x00007fb26372c08d in ?? () from /usr/lib64/libtdb.so.1 No symbol table info available. #15 0x00007fb26372c21d in tdb_traverse_read () from /usr/lib64/libtdb.so.1 No symbol table info available. #16 0x00007fb2646fc7b7 in db_tdb_traverse_read (db=0x5592b4957500, f=0x7fb265561001 <printer_list_exec_fn>, private_data=0x7ffdf83aa9f0) at ../../lib/dbwrap/dbwrap_tdb.c:413 db_ctx = 0x5592b5249b50 ctx = { db = 0x5592b4957500, f = 0x7fb265561001 <printer_list_exec_fn>, private_data = 0x7ffdf83aa9f0 } #17 0x00007fb2646f83ad in dbwrap_traverse_read (db=0x5592b4957500, f=0x7fb265561001 <printer_list_exec_fn>, private_data=0x7ffdf83aa9f0, count=0x0) at ../../lib/dbwrap/dbwrap.c:412 ret = 0 #18 0x00007fb265560d9b in printer_list_traverse (fn=0x7fb265561001 <printer_list_exec_fn>, private_data=0x7ffdf83aa9f0, read_only=true) at ../../source3/printing/printer_list.c:328 db = 0x5592b4957500 status = { v = 0 } #19 0x00007fb2655611cc in printer_list_read_run_fn (fn=0x7fb2653e5970 <lp_add_one_printer>, private_data=0x0) at ../../source3/printing/printer_list.c:464 state = { fn = 0x7fb2653e5970 <lp_add_one_printer>, private_data = 0x0, status = { v = 0 } } status = { v = 0 } #20 0x00007fb26555c9e6 in load_printers () at ../../source3/printing/load.c:86 status = { v = 0 } __func__ = "load_printers" #21 0x00007fb265599457 in delete_and_reload_printers () at ../../source3/smbd/server_reload.c:80 n_services = -130372992 pnum = 12 snum = 12 pname = 0x5592b55626f0 "\340=\277\264\222U" ok = true pcap_last_update = 17286 frame = 0x5592b4797d70 lp_sub = 0x7fb265461a60 <s3_global_substitution> __FUNCTION__ = "delete_and_reload_printers" #22 0x00007fb2655404d7 in delete_and_reload_printers_full (ev=0x5592b44a6940, msg_ctx=0x5592b44a92c0) at ../../source3/printing/queue_process.c:131 session_info = 0x5592b55626f0 pinfo2 = 0x0 lp_sub = 0x7fb265461a60 <s3_global_substitution> n_services = 13 pnum = -1 snum = 13 pname = 0x5592b45003d0 "\240\247F\264\222U" sname = 0x7ffdf83aab00 "\200\253:\370\375\177" status = { v = 0 } __FUNCTION__ = "delete_and_reload_printers_full" #23 0x00007fb265540523 in reload_pcap_change_notify (ev=0x5592b44a6940, msg_ctx=0x5592b44a92c0) at ../../source3/printing/queue_process.c:150 No locals. #24 0x00007fb265555855 in cups_async_callback (event_ctx=0x5592b44a6940, event=0x5592b5562570, flags=1, p=0x5592b4a9b160) at ../../source3/printing/print_cups.c:571 frame = 0x5592b4e26960 cb_args = 0x5592b4a9b160 tmp_pcap_cache = 0x5592b45003d0 ret_ok = true pcap_data = { status = { v = 0 }, count = 1, printers = 0x5592b5393800 } pcap_blob = { data = 0x5592b47a48e0 "\001", length = 157 } ndr_ret = NDR_ERR_SUCCESS i = 1 __FUNCTION__ = "cups_async_callback" #25 0x00007fb26548b88c in tevent_common_invoke_fd_handler (fde=0x5592b5562570, flags=1, removed=0x0) at ../../lib/tevent/tevent_fd.c:138 handler_ev = 0x5592b44a6940 #26 0x00007fb265496148 in epoll_event_loop (epoll_ev=0x5592b4a30eb0, tvalp=0x7ffdf83aac50) at ../../lib/tevent/tevent_epoll.c:736 fde = 0x5592b5562570 flags = 1 mpx_fde = 0x0 ret = 1 i = 0 events = {[0] = { events = 17, data = { ptr = 0x5592b5562570, fd = -1252645520, u32 = 3042321776, u64 = 94088595907952 } }} timeout = 750000 wait_errno = 0 #27 0x00007fb26549678f in epoll_event_loop_once (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent_epoll.c:937 epoll_ev = 0x5592b4a30eb0 tval = { tv_sec = 749, tv_usec = 999054 } panic_triggered = false #28 0x00007fb2654930fa in std_event_loop_once (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent_standard.c:110 glue_ptr = 0x5592b44aa700 glue = 0x5592b44aa700 ret = 21906 #29 0x00007fb26548aaf7 in _tevent_loop_once (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent.c:772 ret = 21906 nesting_stack_ptr = 0x0 #30 0x00007fb26548ae1e in tevent_common_loop_wait (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent.c:895 ret = 32690 #31 0x00007fb26549319c in std_event_loop_wait (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent_standard.c:141 glue_ptr = 0x5592b44aa700 glue = 0x5592b44aa700 ret = 32690 #32 0x00007fb26548aec1 in _tevent_loop_wait (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent.c:914 No locals. #33 0x00007fb265541028 in start_background_queue (ev=0x5592b44a6940, msg_ctx=0x5592b44a92c0, logfile=0x0) at ../../source3/printing/queue_process.c:424 fde = 0x5592b53bcee0 ret = 21906 status = { v = 0 } pid = 0 state = 0x5592b4bf3d50 pause_pipe = {[0] = -1, [1] = 48} __FUNCTION__ = "start_background_queue" #34 0x00007fb265541154 in printing_subsystem_init (ev_ctx=0x5592b44a6940, msg_ctx=0x5592b44a92c0, dce_ctx=0x5592b44ae3e0, start_daemons=true, background_queue=true) at ../../source3/printing/queue_process.c:457 pid = -1 #35 0x00005592b436b820 in main (argc=5, argv=0x7ffdf83ab2e8) at ../../source3/smbd/server.c:2131 bgq = true ok = false is_daemon = true interactive = false Fork = false no_process_group = false log_stdout = true ports = 0x0 profile_level = 0x0 opt = -1 pc = 0x5592b4496df0 print_build_options = false main_server_id = { pid = 21931, task_id = 0, vnn = 4294967295, unique_id = 7715839874465799134 } OPT_DAEMON = OPT_DAEMON OPT_INTERACTIVE = OPT_INTERACTIVE OPT_FORK = OPT_FORK OPT_NO_PROCESS_GROUP = OPT_NO_PROCESS_GROUP OPT_LOG_STDOUT = OPT_LOG_STDOUT long_options = {[0] = { longName = 0x0, shortName = 0 '\000', argInfo = 4, arg = 0x7fb2650d9400 <poptHelpOptions>, val = 0, descrip = 0x5592b43732e1 "Help options:", argDescrip = 0x0 }, [1] = { longName = 0x5592b43732ef "daemon", shortName = 68 'D', argInfo = 0, arg = 0x0, val = 1000, descrip = 0x5592b43732f6 "Become a daemon (default)", argDescrip = 0x0 }, [2] = { longName = 0x5592b4373310 "interactive", shortName = 105 'i', argInfo = 0, arg = 0x0, val = 1001, descrip = 0x5592b4373320 "Run interactive (not a daemon) and log to stdout", argDescrip = 0x0 }, [3] = { longName = 0x5592b4373351 "foreground", shortName = 70 'F', argInfo = 0, arg = 0x0, val = 1002, descrip = 0x5592b4373360 "Run daemon in foreground (for daemontools, etc.)", argDescrip = 0x0 }, [4] = { longName = 0x5592b4373391 "no-process-group", shortName = 0 '\000', argInfo = 0, arg = 0x0, val = 1003, descrip = 0x5592b43733a8 "Don't create a new process group", argDescrip = 0x0 }, [5] = { longName = 0x5592b43733c9 "log-stdout", shortName = 83 'S', argInfo = 0, arg = 0x0, val = 1004, descrip = 0x5592b43733d4 "Log to stdout", argDescrip = 0x0 }, [6] = { longName = 0x5592b43733e2 "build-options", shortName = 98 'b', argInfo = 0, arg = 0x0, val = 98, descrip = 0x5592b43733f0 "Print build options", argDescrip = 0x0 }, [7] = { longName = 0x5592b4373404 "port", shortName = 112 'p', argInfo = 1, arg = 0x7ffdf83ab158, val = 0, descrip = 0x5592b4373409 "Listen on the specified ports", argDescrip = 0x0 }, [8] = { longName = 0x5592b4373427 "profiling-level", shortName = 80 'P', argInfo = 1, arg = 0x7ffdf83ab150, val = 0, descrip = 0x5592b4373437 "Set profiling level", argDescrip = 0x5592b437344b "PROFILE_LEVEL" }, [9] = { longName = 0x0, shortName = 0 '\000', argInfo = 4, arg = 0x7fb2654a8140 <popt_common_samba>, val = 0, descrip = 0x5592b4373459 "Common samba options:", argDescrip = 0x0 }, [10] = { longName = 0x0, shortName = 0 '\000', argInfo = 0, arg = 0x0, val = 0, descrip = 0x0, argDescrip = 0x0 }} parent = 0x5592b44addf0 frame = 0x5592b448d6b0 status = { v = 0 } ev_ctx = 0x5592b44a6940 msg_ctx = 0x5592b44a92c0 dce_ctx = 0x5592b44ae3e0 server_id = { pid = 21931, task_id = 0, vnn = 4294967295, unique_id = 5659117256920205400 } se = 0x5592b44c0f90 profiling_level = 0 np_dir = 0x5592b4f2bdc0 "/home/asn/workspace/projects/samba/st/fl2003dc/ncalrpc/np" lp_sub = 0x7fb265461a60 <s3_global_substitution> smbd_shim_fns = { send_stat_cache_delete_message = 0x7fb26563ba6e <smbd_send_stat_cache_delete_message>, change_to_root_user = 0x7fb265613e99 <smbd_change_to_root_user>, become_authenticated_pipe_user = 0x7fb265613f4b <smbd_become_authenticated_pipe_user>, unbecome_authenticated_pipe_user = 0x7fb265614067 <smbd_unbecome_authenticated_pipe_user>, contend_level2_oplocks_begin = 0x7fb2656bb8df <smbd_contend_level2_oplocks_begin>, contend_level2_oplocks_end = 0x7fb2656bb902 <smbd_contend_level2_oplocks_end>, become_root = 0x7fb2656142cc <smbd_become_root>, unbecome_root = 0x7fb2656142f5 <smbd_unbecome_root>, exit_server = 0x7fb2656add55 <smbd_exit_server>, exit_server_cleanly = 0x7fb2656add72 <smbd_exit_server_cleanly> } __FUNCTION__ = "main" __func__ = "main" Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Mar 19 18:56:33 UTC 2021 on sn-devel-184

This function already exists in bind9 but takes different arguments, so when the DLZ is loaded and this function is called bind crashes: named[1523]: samba_dlz: allowing update of signer=DESKTOP-8BUKMBK\$\@AFOREST.AD name=118.101.168.192.in-addr.arpa tcpaddr=192.168.101.118 type=PTR key=1264-ms-7.1-2ac9.9ef238e1-9747-11ed-9f95-525400dc6981/159/0 named[1523]: samba_dlz: allowing update of signer=DESKTOP-8BUKMBK\$\@AFOREST.AD name=118.101.168.192.in-addr.arpa tcpaddr=192.168.101.118 type=PTR key=1264-ms-7.1-2ac9.9ef238e1-9747-11ed-9f95-525400dc6981/159/0 named[1523]: client @0x7f26caa90f68 192.168.101.118#58223/key DESKTOP-8BUKMBK\$\@AFOREST.AD: updating zone '101.168.192.in-addr.arpa/NONE': deleting rrset at '118.101.168.192.in-addr.ar named[1523]: name.c:664: REQUIRE(((name1) != ((void *)0) && ((const isc__magic_t *)(name1))->magic == ((('D') << 24 | ('N') << 16 | ('S') << 8 | ('n'))))) failed, back trace Backtrace: #0 0x00007f2716c957ec in __pthread_kill_implementation () from /lib64/libc.so.6 #1 0x00007f2716c42816 in raise () from /lib64/libc.so.6 #2 0x00007f2716c2b81c in abort () from /lib64/libc.so.6 #3 0x000055d4de847995 in assertion_failed (file=<optimized out>, line=<optimized out>, type=<optimized out>, cond=<optimized out>) at /usr/src/debug/bind-9.18.10/bin/named/main.c:237 #4 0x00007f27176388fc in isc_assertion_failed (file=file@entry=0x7f27173b0df6 "name.c", line=line@entry=664, type=type@entry=isc_assertiontype_require, cond=cond@entry=0x7f27173b0268 "((name1) != ((void *)0) && ((const isc__magic_t *)(name1))->magic == ((('D') << 24 | ('N') << 16 | ('S') << 8 | ('n'))))") at /usr/src/debug/bind-9.18.10/lib/isc/assertions.c:48 #5 0x00007f27172946f9 in dns_name_equal (name1=<optimized out>, name2=<optimized out>) at /usr/src/debug/bind-9.18.10/lib/dns/name.c:664 **** Here bind's dns_name_equal() is called instead of samba's dns_name_equal() **** #6 0x00007f27077ad6f2 in dns_record_match (rec1=0x7f26f8042d70, rec2=0x7f26f8044d10) at ../../source4/dns_server/dnsserver_common.c:1346 #7 0x00007f271404732c in b9_record_match (rec1=0x7f26f8042d70, rec2=0x7f26f8044d10) at ../../source4/dns_server/dlz_bind9.c:1830 #8 0x00007f2714047daa in dlz_subrdataset (name=0x7f2706ff82f0 "118.101.168.192.in-addr.arpa", rdatastr=0x7f26c9c10000 "118.101.168.192.in-addr.arpa.\t1200\tIN\tPTR\tDESKTOP-8BUKMBK.aforest.ad.", dbdata=0x7f271003d300, version=0x7f26f8044b20) at ../../source4/dns_server/dlz_bind9.c:2077 #9 0x000055d4de84afb4 in dlopen_dlz_subrdataset (name=0x7f2706ff82f0 "118.101.168.192.in-addr.arpa", rdatastr=<optimized out>, driverarg=<optimized out>, dbdata=0x7f270430f680, version=<optimized out>) at /usr/src/debug/bind-9.18.10/bin/named/dlz_dlopen_driver.c:483 #10 0x00007f271738e734 in modrdataset.constprop.0 (db=0x7f2704291740, node=0x7f26c9c006e0, version=0x7f26f8044b20, rdataset=0x7f2706ff8830, mod_function=0x55d4de84af80 <dlopen_dlz_subrdataset>, options=<optimized out>) at /usr/src/debug/bind-9.18.10/lib/dns/sdlz.c:1107 #11 0x00007f2717251855 in diff_apply (diff=diff@entry=0x7f2706ff8df0, db=db@entry=0x7f2704291740, ver=ver@entry=0x7f26f8044b20, warn=warn@entry=true) at /usr/src/debug/bind-9.18.10/lib/dns/diff.c:370 #12 0x00007f2717251c8a in dns_diff_apply (diff=diff@entry=0x7f2706ff8df0, db=db@entry=0x7f2704291740, ver=ver@entry=0x7f26f8044b20) at /usr/src/debug/bind-9.18.10/lib/dns/diff.c:465 #13 0x00007f2717d105aa in do_one_tuple (tuple=tuple@entry=0x7f2706ff8e50, db=db@entry=0x7f2704291740, ver=ver@entry=0x7f26f8044b20, diff=diff@entry=0x7f2706ff9400) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:454 #14 0x00007f2717d10fff in update_one_rr (rdata=0x7f2706ff8ee8, ttl=<optimized out>, name=<optimized out>, op=DNS_DIFFOP_DEL, diff=0x7f2706ff9400, ver=0x7f26f8044b20, db=0x7f2704291740) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:505 #15 delete_if_action (data=<optimized out>, rr=0x7f2706ff8ee0) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:1427 #16 0x00007f2717d10ccd in foreach_rr (db=0x7f2704291740, ver=<optimized out>, name=0x7f26caa61d00, type=<optimized out>, covers=<optimized out>, rr_action=rr_action@entry=0x7f2717d10f60 <delete_if_action>, rr_action_data=0x7f2706ff9280) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:736 #17 0x00007f2717d10e76 in delete_if (predicate=predicate@entry=0x7f2717d0fb10 <true_p>, db=<optimized out>, ver=<optimized out>, name=<optimized out>, type=<optimized out>, covers=<optimized out>, update_rr=0x7f2706ff94b0, diff=0x7f2706ff9400) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:1454 #18 0x00007f2717d1bccd in update_action (task=<optimized out>, event=<optimized out>) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:3299 #19 0x00007f271765eb4c in task_run (task=0x7f27155ccf00) at /usr/src/debug/bind-9.18.10/lib/isc/task.c:823 #20 isc_task_run (task=0x7f27155ccf00) at /usr/src/debug/bind-9.18.10/lib/isc/task.c:904 #21 0x00007f271762cb12 in isc__nm_async_task (worker=0x7f2716236560, ev0=0x7f26caa07000) at netmgr/netmgr.c:840 #22 process_netievent (worker=worker@entry=0x7f2716236560, ievent=0x7f26caa07000) at netmgr/netmgr.c:918 #23 0x00007f271762d197 in process_queue (worker=worker@entry=0x7f2716236560, type=type@entry=NETIEVENT_TASK) at netmgr/netmgr.c:1011 #24 0x00007f271762d3b3 in process_all_queues (worker=0x7f2716236560) at netmgr/netmgr.c:765 #25 async_cb (handle=0x7f27162368c0) at netmgr/netmgr.c:794 #26 0x00007f2717c4cb0d in uv__async_io (loop=0x7f2716236570, w=<optimized out>, events=<optimized out>) at src/unix/async.c:163 #27 0x00007f2717c6825d in uv__io_poll (loop=0x7f2716236570, timeout=<optimized out>) at src/unix/epoll.c:374 #28 0x00007f2717c5247a in uv__io_poll (timeout=<optimized out>, loop=0x7f2716236570) at src/unix/udp.c:122 #29 uv_run (loop=loop@entry=0x7f2716236570, mode=mode@entry=UV_RUN_DEFAULT) at src/unix/core.c:406 #30 0x00007f271762d834 in nm_thread (worker0=0x7f2716236560) at netmgr/netmgr.c:696 #31 0x00007f27176627f5 in isc__trampoline_run (arg=0x55d4dfe3ad70) at /usr/src/debug/bind-9.18.10/lib/isc/trampoline.c:189 #32 0x00007f2716c9398d in start_thread () from /lib64/libc.so.6 #33 0x00007f2716d19344 in clone () from /lib64/libc.so.6 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14030 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Samuel Cabrero <scabrero@samba.org> Autobuild-Date(master): Thu Jan 19 10:20:27 UTC 2023 on atb-devel-224

This function already exists in bind9 but takes different arguments, so when the DLZ is loaded and this function is called bind crashes: named[1523]: samba_dlz: allowing update of signer=DESKTOP-8BUKMBK\$\@AFOREST.AD name=118.101.168.192.in-addr.arpa tcpaddr=192.168.101.118 type=PTR key=1264-ms-7.1-2ac9.9ef238e1-9747-11ed-9f95-525400dc6981/159/0 named[1523]: samba_dlz: allowing update of signer=DESKTOP-8BUKMBK\$\@AFOREST.AD name=118.101.168.192.in-addr.arpa tcpaddr=192.168.101.118 type=PTR key=1264-ms-7.1-2ac9.9ef238e1-9747-11ed-9f95-525400dc6981/159/0 named[1523]: client @0x7f26caa90f68 192.168.101.118#58223/key DESKTOP-8BUKMBK\$\@AFOREST.AD: updating zone '101.168.192.in-addr.arpa/NONE': deleting rrset at '118.101.168.192.in-addr.ar named[1523]: name.c:664: REQUIRE(((name1) != ((void *)0) && ((const isc__magic_t *)(name1))->magic == ((('D') << 24 | ('N') << 16 | ('S') << 8 | ('n'))))) failed, back trace Backtrace: #0 0x00007f2716c957ec in __pthread_kill_implementation () from /lib64/libc.so.6 #1 0x00007f2716c42816 in raise () from /lib64/libc.so.6 #2 0x00007f2716c2b81c in abort () from /lib64/libc.so.6 #3 0x000055d4de847995 in assertion_failed (file=<optimized out>, line=<optimized out>, type=<optimized out>, cond=<optimized out>) at /usr/src/debug/bind-9.18.10/bin/named/main.c:237 #4 0x00007f27176388fc in isc_assertion_failed (file=file@entry=0x7f27173b0df6 "name.c", line=line@entry=664, type=type@entry=isc_assertiontype_require, cond=cond@entry=0x7f27173b0268 "((name1) != ((void *)0) && ((const isc__magic_t *)(name1))->magic == ((('D') << 24 | ('N') << 16 | ('S') << 8 | ('n'))))") at /usr/src/debug/bind-9.18.10/lib/isc/assertions.c:48 #5 0x00007f27172946f9 in dns_name_equal (name1=<optimized out>, name2=<optimized out>) at /usr/src/debug/bind-9.18.10/lib/dns/name.c:664 **** Here bind's dns_name_equal() is called instead of samba's dns_name_equal() **** #6 0x00007f27077ad6f2 in dns_record_match (rec1=0x7f26f8042d70, rec2=0x7f26f8044d10) at ../../source4/dns_server/dnsserver_common.c:1346 #7 0x00007f271404732c in b9_record_match (rec1=0x7f26f8042d70, rec2=0x7f26f8044d10) at ../../source4/dns_server/dlz_bind9.c:1830 #8 0x00007f2714047daa in dlz_subrdataset (name=0x7f2706ff82f0 "118.101.168.192.in-addr.arpa", rdatastr=0x7f26c9c10000 "118.101.168.192.in-addr.arpa.\t1200\tIN\tPTR\tDESKTOP-8BUKMBK.aforest.ad.", dbdata=0x7f271003d300, version=0x7f26f8044b20) at ../../source4/dns_server/dlz_bind9.c:2077 #9 0x000055d4de84afb4 in dlopen_dlz_subrdataset (name=0x7f2706ff82f0 "118.101.168.192.in-addr.arpa", rdatastr=<optimized out>, driverarg=<optimized out>, dbdata=0x7f270430f680, version=<optimized out>) at /usr/src/debug/bind-9.18.10/bin/named/dlz_dlopen_driver.c:483 #10 0x00007f271738e734 in modrdataset.constprop.0 (db=0x7f2704291740, node=0x7f26c9c006e0, version=0x7f26f8044b20, rdataset=0x7f2706ff8830, mod_function=0x55d4de84af80 <dlopen_dlz_subrdataset>, options=<optimized out>) at /usr/src/debug/bind-9.18.10/lib/dns/sdlz.c:1107 #11 0x00007f2717251855 in diff_apply (diff=diff@entry=0x7f2706ff8df0, db=db@entry=0x7f2704291740, ver=ver@entry=0x7f26f8044b20, warn=warn@entry=true) at /usr/src/debug/bind-9.18.10/lib/dns/diff.c:370 #12 0x00007f2717251c8a in dns_diff_apply (diff=diff@entry=0x7f2706ff8df0, db=db@entry=0x7f2704291740, ver=ver@entry=0x7f26f8044b20) at /usr/src/debug/bind-9.18.10/lib/dns/diff.c:465 #13 0x00007f2717d105aa in do_one_tuple (tuple=tuple@entry=0x7f2706ff8e50, db=db@entry=0x7f2704291740, ver=ver@entry=0x7f26f8044b20, diff=diff@entry=0x7f2706ff9400) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:454 #14 0x00007f2717d10fff in update_one_rr (rdata=0x7f2706ff8ee8, ttl=<optimized out>, name=<optimized out>, op=DNS_DIFFOP_DEL, diff=0x7f2706ff9400, ver=0x7f26f8044b20, db=0x7f2704291740) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:505 #15 delete_if_action (data=<optimized out>, rr=0x7f2706ff8ee0) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:1427 #16 0x00007f2717d10ccd in foreach_rr (db=0x7f2704291740, ver=<optimized out>, name=0x7f26caa61d00, type=<optimized out>, covers=<optimized out>, rr_action=rr_action@entry=0x7f2717d10f60 <delete_if_action>, rr_action_data=0x7f2706ff9280) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:736 #17 0x00007f2717d10e76 in delete_if (predicate=predicate@entry=0x7f2717d0fb10 <true_p>, db=<optimized out>, ver=<optimized out>, name=<optimized out>, type=<optimized out>, covers=<optimized out>, update_rr=0x7f2706ff94b0, diff=0x7f2706ff9400) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:1454 #18 0x00007f2717d1bccd in update_action (task=<optimized out>, event=<optimized out>) at /usr/src/debug/bind-9.18.10/lib/ns/update.c:3299 #19 0x00007f271765eb4c in task_run (task=0x7f27155ccf00) at /usr/src/debug/bind-9.18.10/lib/isc/task.c:823 #20 isc_task_run (task=0x7f27155ccf00) at /usr/src/debug/bind-9.18.10/lib/isc/task.c:904 #21 0x00007f271762cb12 in isc__nm_async_task (worker=0x7f2716236560, ev0=0x7f26caa07000) at netmgr/netmgr.c:840 #22 process_netievent (worker=worker@entry=0x7f2716236560, ievent=0x7f26caa07000) at netmgr/netmgr.c:918 #23 0x00007f271762d197 in process_queue (worker=worker@entry=0x7f2716236560, type=type@entry=NETIEVENT_TASK) at netmgr/netmgr.c:1011 #24 0x00007f271762d3b3 in process_all_queues (worker=0x7f2716236560) at netmgr/netmgr.c:765 #25 async_cb (handle=0x7f27162368c0) at netmgr/netmgr.c:794 #26 0x00007f2717c4cb0d in uv__async_io (loop=0x7f2716236570, w=<optimized out>, events=<optimized out>) at src/unix/async.c:163 #27 0x00007f2717c6825d in uv__io_poll (loop=0x7f2716236570, timeout=<optimized out>) at src/unix/epoll.c:374 #28 0x00007f2717c5247a in uv__io_poll (timeout=<optimized out>, loop=0x7f2716236570) at src/unix/udp.c:122 #29 uv_run (loop=loop@entry=0x7f2716236570, mode=mode@entry=UV_RUN_DEFAULT) at src/unix/core.c:406 #30 0x00007f271762d834 in nm_thread (worker0=0x7f2716236560) at netmgr/netmgr.c:696 #31 0x00007f27176627f5 in isc__trampoline_run (arg=0x55d4dfe3ad70) at /usr/src/debug/bind-9.18.10/lib/isc/trampoline.c:189 #32 0x00007f2716c9398d in start_thread () from /lib64/libc.so.6 #33 0x00007f2716d19344 in clone () from /lib64/libc.so.6 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14030 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Samuel Cabrero <scabrero@samba.org> Autobuild-Date(master): Thu Jan 19 10:20:27 UTC 2023 on atb-devel-224 (cherry picked from commit fcecdfa)

==395==ERROR: LeakSanitizer: detected memory leaks Direct leak of 96 byte(s) in 1 object(s) allocated from: #0 0x7f4c5dedc03f in malloc (/lib64/libasan.so.8+0xdc03f) (BuildId: b10bafa0ba3304197db35cc24e0024cb0492168a) #1 0x7f4c5d252b3e in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f4c5d2543cc in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f4c5d2543cc in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f4c5d2543cc in talloc_named_const ../../lib/talloc/talloc.c:1751 #5 0x7f4c504acc53 in partition_metadata_get_uint64 ../../source4/dsdb/samdb/ldb_modules/partition_metadata.c:50 #6 0x7f4c504add29 in partition_metadata_sequence_number_increment ../../source4/dsdb/samdb/ldb_modules/partition_metadata.c:398 #7 0x7f4c504a66aa in partition_sequence_number ../../source4/dsdb/samdb/ldb_modules/partition.c:1401 #8 0x7f4c504a66aa in partition_extended ../../source4/dsdb/samdb/ldb_modules/partition.c:1680 #9 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #10 0x7f4c503980c8 in replmd_extended ../../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:8455 #11 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #12 0x7f4c502fae5c in samldb_extended ../../source4/dsdb/samdb/ldb_modules/samldb.c:5718 #13 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #14 0x7f4c52f0b94c in acl_extended ../../source4/dsdb/samdb/ldb_modules/acl.c:2854 #15 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #16 0x7f4c52eb019c in descriptor_extended ../../source4/dsdb/samdb/ldb_modules/descriptor.c:1450 #17 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #18 0x7f4c52ed8687 in log_extended ../../source4/dsdb/samdb/ldb_modules/audit_log.c:1824 #19 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #20 0x7f4c505aa337 in unlazy_op ../../source4/dsdb/samdb/ldb_modules/lazy_commit.c:40 #21 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #22 0x7f4c502d0f82 in schema_load_extended ../../source4/dsdb/samdb/ldb_modules/schema_load.c:593 #23 0x7f4c5c498c44 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:559 #24 0x7f4c5035a010 in rootdse_extended ../../source4/dsdb/samdb/ldb_modules/rootdse.c:1780 #25 0x7f4c5c4914ef in ldb_request ../../lib/ldb/common/ldb.c:1244 #26 0x7f4c5c492a2d in ldb_extended ../../lib/ldb/common/ldb.c:1714 #27 0x7f4c5c492bdf in ldb_sequence_number ../../lib/ldb/common/ldb.c:1943 #28 0x7f4c503a9abd in replmd_add ../../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:1316 #29 0x7f4c5c4989f4 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:543 #30 0x7f4c50458783 in rdn_name_add ../../lib/ldb/modules/rdn_name.c:206 #31 0x7f4c5c4989f4 in ldb_next_request ../../lib/ldb/common/ldb_modules.c:543 #32 0x7f4c504f4852 in attr_handler ../../source4/dsdb/samdb/ldb_modules/objectclass_attrs.c:334 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>

Commit e07f890 broke handling of NT4 domains which lack a DNS domain names. As the dns_name is NULL, talloc_steal(dns_name) returns NULL, which causes _wbint_ListTrustedDomains to return NT_STATUS_NO_MEMORY. To make things worse, at that point the new struct netr_DomainTrust is not yet initialized correctly and the "out->count = n + 1" already increased the array counter at the start of the loop without initializing it. Later when NDR-pushing the result in dcesrv_call_dispatch_local(), the ndr_push() can crash when accesssing the ununitialized values: 2023-12-08T14:07:42.759691+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: =============================================================== 2023-12-08T14:07:42.759702+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: INTERNAL ERROR: Signal 11: Segmentation fault in winbindd (wb[ADDOMAIN]) (domain child [ADDOMAIN]) pid 157227 (4.20.0pre1-DEVELOPERBUILD) 2023-12-08T14:07:42.759712+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting 2023-12-08T14:07:42.759723+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: =============================================================== 2023-12-08T14:07:42.759730+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: PANIC (pid 157227): Signal 11: Segmentation fault in 4.20.0pre1-DEVELOPERBUILD 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: BACKTRACE: 36 stack frames: 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #0 bin/shared/private/libgenrand-samba4.so(log_stack_trace+0x1f) [0x7f1396acd441] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #1 bin/shared/private/libgenrand-samba4.so(smb_panic_log+0x20f) [0x7f1396acd3d5] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #2 bin/shared/private/libgenrand-samba4.so(smb_panic+0x18) [0x7f1396acd3f0] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #3 bin/shared/private/libgenrand-samba4.so(+0x2eb5) [0x7f1396acceb5] 92023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #4 bin/shared/private/libgenrand-samba4.so(+0x2eca) [0x7f1396acceca] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #5 /lib64/libc.so.6(+0x3dbb0) [0x7f139687abb0] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #6 bin/shared/private/libsamba-security-samba4.so(ndr_push_dom_sid2+0x2a) [0x7f13977e5437] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #7 bin/shared/libndr-standard.so.0(ndr_push_netr_DomainTrust+0x4ad) [0x7f1396deb64c] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #8 bin/shared/libndr-standard.so.0(ndr_push_netr_DomainTrustList+0x204) [0x7f1396dec7a9] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #9 bin/shared/private/libndr-samba4.so(+0x239bf9) [0x7f1397639bf9] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #10 winbindd: domain child [ADDOMAIN](winbind__op_ndr_push+0x5a) [0x55741e6857a8] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #11 bin/shared/libdcerpc-server-core.so.0(dcesrv_call_dispatch_local+0x49b) [0x7f1397be6219] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #12 winbindd: domain child [ADDOMAIN](winbindd_dual_ndrcmd+0x375) [0x55741e67a204] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #13 winbindd: domain child [ADDOMAIN](+0x9cf0d) [0x55741e674f0d] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #14 winbindd: domain child [ADDOMAIN](+0x9f792) [0x55741e677792] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #15 bin/shared/private/libtevent-samba4.so(tevent_common_invoke_fd_handler+0x121) [0x7f139802f816] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #16 bin/shared/private/libtevent-samba4.so(+0x19cef) [0x7f139803bcef] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #17 bin/shared/private/libtevent-samba4.so(+0x1a3dc) [0x7f139803c3dc] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #18 bin/shared/private/libtevent-samba4.so(+0x15b52) [0x7f1398037b52] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #19 bin/shared/private/libtevent-samba4.so(_tevent_loop_once+0x113) [0x7f139802e1db] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #20 winbindd: domain child [ADDOMAIN](+0xa03ca) [0x55741e6783ca] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #21 winbindd: domain child [ADDOMAIN](+0x9ba9c) [0x55741e673a9c] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #22 bin/shared/private/libtevent-samba4.so(_tevent_req_notify_callback+0xba) [0x7f139803194a] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #23 bin/shared/private/libtevent-samba4.so(+0xfadb) [0x7f1398031adb] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #24 bin/shared/private/libtevent-samba4.so(_tevent_req_done+0x25) [0x7f1398031b07] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #25 bin/shared/private/libtevent-samba4.so(+0xf125) [0x7f1398031125] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #26 bin/shared/private/libtevent-samba4.so(+0xe9cf) [0x7f13980309cf] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #27 bin/shared/private/libtevent-samba4.so(tevent_common_invoke_immediate_handler+0x207) [0x7f1398030343] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #28 bin/shared/private/libtevent-samba4.so(tevent_common_loop_immediate+0x37) [0x7f13980304b5] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #29 bin/shared/private/libtevent-samba4.so(+0x1a332) [0x7f139803c332] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #30 bin/shared/private/libtevent-samba4.so(+0x15b52) [0x7f1398037b52] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #31 bin/shared/private/libtevent-samba4.so(_tevent_loop_once+0x113) [0x7f139802e1db] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #32 winbindd: domain child [ADDOMAIN](main+0x1689) [0x55741e6b210a] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #33 /lib64/libc.so.6(+0x27b8a) [0x7f1396864b8a] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #34 /lib64/libc.so.6(__libc_start_main+0x8b) [0x7f1396864c4b] 2023-12-08T14:07:42.760443+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: #35 winbindd: domain child [ADDOMAIN](_start+0x25) [0x55741e63a045] 2023-12-08T14:07:42.760685+00:00 localadmember.addom.samba.example.com log.winbindd[157227]: smb_panic(): calling panic action [cd /data/git/samba/scratch3 && /data/git/samba/scratch3/selftest/gdb_backtrace 157227 ./bin/winbindd] Deferring assignment of r->out.domains->array and r->out.domains->count to the end of the function ensures we don't return inconsistent state in case of an error. Also, r->out.domains is already set by the NDR layer, no need to create and assign a struct netr_DomainTrustList object. Using talloc_move() ensures we don't leave dangling pointers. Better to crash reliably on accessing NULL, then accessing some unknown memory via a wild pointer. As talloc_move() can't fail, there's no need to check the return value. And using a struct initializer ensures all members are properly initialized. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15533 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Jan 20 14:23:51 UTC 2024 on atb-devel-224

Indirect leak of 792 byte(s) in 1 object(s) allocated from: #0 0x7f261b8dc03f in malloc (/lib64/libasan.so.8+0xdc03f) (BuildId: 3e1694ad218c99a8b1b69231666a27df63cf19d0) #1 0x7f261b2c2bc2 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f261b2c473d in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f261b2c473d in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f261b2c473d in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7f2618cb42bc in smbXcli_conn_create ../../libcli/smb/smbXcli_base.c:350 #6 0x7f261a74acd3 in cli_state_create ../../source3/libsmb/clientgen.c:196 #7 0x7f261a751f0d in cli_connect_nb_done ../../source3/libsmb/cliconnect.c:2715 #8 0x7f261a69bacf in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #9 0x7f261a69bd06 in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #10 0x7f261a69bd6e in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #11 0x7f261a752dde in cli_connect_sock_done ../../source3/libsmb/cliconnect.c:2624 #12 0x7f261a69bacf in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #13 0x7f261a69bd06 in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #14 0x7f261a69bd6e in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #15 0x7f261a7ba2c4 in smbsock_any_connect_connected ../../source3/libsmb/smbsock_connect.c:788 #16 0x7f261a69bacf in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #17 0x7f261a69bd06 in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #18 0x7f261a69bd6e in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #19 0x7f261a7b75ad in smbsock_connect_connected ../../source3/libsmb/smbsock_connect.c:524 #20 0x7f261a69bacf in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7f261a69bd06 in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7f261a69bd6e in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #23 0x7f261b4b400a in open_socket_out_connected ../../source3/lib/util_sock.c:484 #24 0x7f261a69bacf in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7f261a69bd06 in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7f261a69be3e in tevent_req_trigger ../../lib/tevent/tevent_req.c:291 #27 0x7f261a699df4 in tevent_common_invoke_immediate_handler ../../lib/tevent/tevent_immediate.c:190 #28 0x7f261a699e31 in tevent_common_loop_immediate ../../lib/tevent/tevent_immediate.c:236 #29 0x7f261a6ad3ec in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:905 #30 0x7f261a6a679e in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #31 0x7f261a696538 in _tevent_loop_once ../../lib/tevent/tevent.c:820 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Apr 29 09:48:47 UTC 2024 on atb-devel-224

==20978==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f4f91ff51a0 at pc 0x7f4f94cf93d6 bp 0x7ffdb90fc510 sp 0x7ffdb90fbcd0 READ of size 64 at 0x7f4f91ff51a0 thread T0 #0 0x7f4f94cf93d5 in memcpy ../../../../libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 #1 0x7f4f933bdb67 in ldb_val_dup ../../lib/ldb/common/ldb_msg.c:325 #2 0x7f4f933c11d1 in ldb_msg_copy ../../lib/ldb/common/ldb_msg.c:1182 #3 0x7f4f933c13d2 in ldb_msg_normalize ../../lib/ldb/common/ldb_msg.c:1235 #4 0x7f4f933ab556 in ldb_request ../../lib/ldb/common/ldb.c:1196 #5 0x7f4f8e82b1d4 in dsdb_autotransaction_request ../../source4/dsdb/common/util.c:1220 #6 0x7f4f8e831c8a in dsdb_add ../../source4/dsdb/common/util.c:5354 #7 0x7f4f8e853a01 in gkdi_create_root_key ../../source4/dsdb/gmsa/gkdi.c:493 #8 0x7f4f8e853a01 in gkdi_new_root_key ../../source4/dsdb/gmsa/gkdi.c:551 #9 0x7f4f8cd4ca52 in py_dsdb_create_gkdi_root_key ../../source4/dsdb/pydsdb.c:1388 #10 0x7f4f947ce01c (/lib64/libpython3.11.so.1.0+0x1ce01c) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #11 0x7f4f947de4c0 in _PyObject_Call (/lib64/libpython3.11.so.1.0+0x1de4c0) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #12 0x7f4f947be6ca in _PyEval_EvalFrameDefault (/lib64/libpython3.11.so.1.0+0x1be6ca) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #13 0x7f4f947b6e79 (/lib64/libpython3.11.so.1.0+0x1b6e79) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #14 0x7f4f947de5d8 (/lib64/libpython3.11.so.1.0+0x1de5d8) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #15 0x7f4f947be6ca in _PyEval_EvalFrameDefault (/lib64/libpython3.11.so.1.0+0x1be6ca) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #16 0x7f4f947b6e79 (/lib64/libpython3.11.so.1.0+0x1b6e79) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #17 0x7f4f947edabb (/lib64/libpython3.11.so.1.0+0x1edabb) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #18 0x7f4f947de5d8 (/lib64/libpython3.11.so.1.0+0x1de5d8) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #19 0x7f4f947be6ca in _PyEval_EvalFrameDefault (/lib64/libpython3.11.so.1.0+0x1be6ca) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #20 0x7f4f947b6e79 (/lib64/libpython3.11.so.1.0+0x1b6e79) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #21 0x7f4f947ed9fb (/lib64/libpython3.11.so.1.0+0x1ed9fb) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #22 0x7f4f947be6ca in _PyEval_EvalFrameDefault (/lib64/libpython3.11.so.1.0+0x1be6ca) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #23 0x7f4f947b6e79 (/lib64/libpython3.11.so.1.0+0x1b6e79) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #24 0x7f4f947be6ca in _PyEval_EvalFrameDefault (/lib64/libpython3.11.so.1.0+0x1be6ca) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #25 0x7f4f947b6e79 (/lib64/libpython3.11.so.1.0+0x1b6e79) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #26 0x7f4f94839997 in PyEval_EvalCode (/lib64/libpython3.11.so.1.0+0x239997) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #27 0x7f4f94856862 (/lib64/libpython3.11.so.1.0+0x256862) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #28 0x7f4f94852e59 (/lib64/libpython3.11.so.1.0+0x252e59) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #29 0x7f4f94868fb1 (/lib64/libpython3.11.so.1.0+0x268fb1) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #30 0x7f4f948687a3 in _PyRun_SimpleFileObject (/lib64/libpython3.11.so.1.0+0x2687a3) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #31 0x7f4f94868453 in _PyRun_AnyFileObject (/lib64/libpython3.11.so.1.0+0x268453) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #32 0x7f4f94861c53 in Py_RunMain (/lib64/libpython3.11.so.1.0+0x261c53) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #33 0x7f4f94829996 in Py_BytesMain (/lib64/libpython3.11.so.1.0+0x229996) (BuildId: 170cbf941d17f6c2ac4f784129b31ebaa10c44a7) #34 0x7f4f9422a1ef in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #35 0x7f4f9422a2b8 in __libc_start_main_impl ../csu/libc-start.c:360 #36 0x5604497e3084 in _start (/usr/bin/python3.11+0x1084) (BuildId: f5d6e3bdbf9098a6ddde0b7f2e07ffc9ad1b1dc3) Address 0x7f4f91ff51a0 is located in stack of thread T0 at offset 416 in frame #0 0x7f4f8e852b37 in gkdi_new_root_key ../../source4/dsdb/gmsa/gkdi.c:537 This frame has 12 object(s): [32, 40) 'root_key_dn' (line 539) [64, 72) 'res' (line 540) [96, 104) 'server_config_res' (line 118) [128, 136) 'kdf_algorithm' (line 128) [160, 168) 'domain_dn' (line 388) [192, 208) 'kdf_parameters_blob' (line 129) [224, 240) 'root_key_data_blob' (line 353) [256, 272) 'guid_blob' (line 467) [288, 312) 'kdf_parameters' (line 226) [352, 368) 'root_key_id' (line 116) [384, 400) 'guid_buf' (line 466) [416, 480) 'root_key_data' (line 352) <== Memory access at offset 416 is inside this variable Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <jsutton@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri May 3 12:20:55 UTC 2024 on atb-devel-224

==36258==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51300000b096 at pc 0x7fb6b4880b46 bp 0x7ffc67d44b40 sp 0x7ffc67d44300 READ of size 1 at 0x51300000b096 thread T0 #0 0x7fb6b4880b45 in strlen ../../../../libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:391 #1 0x560fe898cde3 in winbindd_wins_byip_done ../../source3/winbindd/winbindd_wins_byip.c:111 #2 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #3 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #4 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #5 0x7fb6b1e24c80 in node_status_query_done ../../source3/libsmb/namequery.c:904 #6 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #7 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #8 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #9 0x7fb6b1e250bc in nb_trans_done ../../source3/libsmb/namequery.c:756 #10 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #11 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #12 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #13 0x7fb6b1e270af in sock_packet_read_got_socket ../../source3/libsmb/namequery.c:537 #14 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #17 0x7fb6b33db183 in tdgram_recvfrom_done ../../lib/tsocket/tsocket.c:240 #18 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #19 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #20 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #21 0x7fb6b33e0d99 in tdgram_bsd_recvfrom_handler ../../lib/tsocket/tsocket_bsd.c:1087 #22 0x7fb6b33e0263 in tdgram_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:811 #23 0x7fb6b4ef5ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #24 0x7fb6b4f0b185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #25 0x7fb6b4f0b185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #26 0x7fb6b4f037b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #27 0x7fb6b4ef3549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #28 0x560fe8a15198 in main ../../source3/winbindd/winbindd.c:1729 #29 0x7fb6afe2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #30 0x7fb6afe2a378 in __libc_start_main_impl ../csu/libc-start.c:360 #31 0x560fe89454e4 in _start ../sysdeps/x86_64/start.S:115 0x51300000b096 is located 12 bytes after 330-byte region [0x51300000af40,0x51300000b08a) allocated by thread T0 here: #0 0x7fb6b48fc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7fb6b3a64c57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7fb6b3a66acf in __talloc ../../lib/talloc/talloc.c:825 #3 0x7fb6b3a66acf in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7fb6b3a66acf in _talloc_array ../../lib/talloc/talloc.c:2784 #5 0x7fb6b1e2b43e in parse_node_status ../../source3/libsmb/namequery.c:337 #6 0x7fb6b1e2b43e in node_status_query_recv ../../source3/libsmb/namequery.c:921 #7 0x560fe898cc4f in winbindd_wins_byip_done ../../source3/winbindd/winbindd_wins_byip.c:87 #8 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #9 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #10 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #11 0x7fb6b1e24c80 in node_status_query_done ../../source3/libsmb/namequery.c:904 #12 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #13 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #14 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #15 0x7fb6b1e250bc in nb_trans_done ../../source3/libsmb/namequery.c:756 #16 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #17 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #18 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #19 0x7fb6b1e270af in sock_packet_read_got_socket ../../source3/libsmb/namequery.c:537 #20 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #23 0x7fb6b33db183 in tdgram_recvfrom_done ../../lib/tsocket/tsocket.c:240 #24 0x7fb6b4ef8ae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7fb6b4ef8d1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7fb6b4ef8d84 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #27 0x7fb6b33e0d99 in tdgram_bsd_recvfrom_handler ../../lib/tsocket/tsocket_bsd.c:1087 #28 0x7fb6b33e0263 in tdgram_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:811 #29 0x7fb6b4ef5ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #30 0x7fb6b4f0b185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #31 0x7fb6b4f0b185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #32 0x7fb6b4f037b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #33 0x7fb6b4ef3549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>

We need to detach dcesrv_iface_state from dcesrv_assoc_group, if dcesrv_assoc_group is free'ed first. ==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778 READ of size 8 at 0x50d000004f80 thread T0 #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166 #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080 #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764 #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360 #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115 0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98) freed by thread T0 here: #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222 #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473 #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143 #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175 #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 previously allocated by thread T0 here: #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681 #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730 #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158 #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324 #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222 #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489 #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558 #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343 #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371 #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431 #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144 #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426 #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316 #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>

We need to detach dcesrv_iface_state from dcesrv_assoc_group, if dcesrv_assoc_group is free'ed first. Typically this doesn't happen, but it does when rpc_worker_connection_terminated explicitly calls talloc_unlink(conn, conn->assoc_group) and dcesrv_iface_state_store_conn() is used. But we better do it in all assoc_group destructors. ==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778 READ of size 8 at 0x50d000004f80 thread T0 #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166 #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080 #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764 #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360 #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115 0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98) freed by thread T0 here: #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222 #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473 #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143 #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175 #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 previously allocated by thread T0 here: #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681 #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730 #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158 #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324 #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222 #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489 #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558 #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343 #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371 #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431 #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144 #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426 #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316 #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>

We need to detach dcesrv_iface_state from dcesrv_assoc_group, if dcesrv_assoc_group is free'ed first. ==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778 READ of size 8 at 0x50d000004f80 thread T0 #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166 #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080 #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764 #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360 #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115 0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98) freed by thread T0 here: #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222 #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473 #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143 #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175 #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 previously allocated by thread T0 here: #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681 #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730 #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158 #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324 #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222 #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489 #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558 #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343 #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371 #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431 #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144 #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426 #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316 #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit 5b92986)

We need to detach dcesrv_iface_state from dcesrv_assoc_group, if dcesrv_assoc_group is free'ed first. Typically this doesn't happen, but it does when rpc_worker_connection_terminated explicitly calls talloc_unlink(conn, conn->assoc_group) and dcesrv_iface_state_store_conn() is used. But we better do it in all assoc_group destructors. ==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778 READ of size 8 at 0x50d000004f80 thread T0 #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166 #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080 #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764 #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360 #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115 0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98) freed by thread T0 here: #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222 #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473 #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143 #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175 #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 previously allocated by thread T0 here: #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681 #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730 #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158 #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324 #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222 #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489 #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558 #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343 #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371 #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431 #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144 #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426 #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316 #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit 627a785)

We need to detach dcesrv_iface_state from dcesrv_assoc_group, if dcesrv_assoc_group is free'ed first. ==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778 READ of size 8 at 0x50d000004f80 thread T0 #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166 #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080 #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764 #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360 #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115 0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98) freed by thread T0 here: #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222 #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473 #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143 #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175 #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 previously allocated by thread T0 here: #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681 #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730 #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158 #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324 #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222 #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489 #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558 #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343 #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371 #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431 #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144 #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426 #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316 #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit 5b92986)

We need to detach dcesrv_iface_state from dcesrv_assoc_group, if dcesrv_assoc_group is free'ed first. Typically this doesn't happen, but it does when rpc_worker_connection_terminated explicitly calls talloc_unlink(conn, conn->assoc_group) and dcesrv_iface_state_store_conn() is used. But we better do it in all assoc_group destructors. ==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778 READ of size 8 at 0x50d000004f80 thread T0 #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166 #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080 #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764 #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360 #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115 0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98) freed by thread T0 here: #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222 #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473 #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143 #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175 #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158 #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184 #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792 #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263 #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251 #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968 #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196 #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46 #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612 #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313 #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593 #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252 #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697 #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 previously allocated by thread T0 here: #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825 #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681 #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730 #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158 #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324 #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222 #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489 #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558 #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343 #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371 #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431 #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144 #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426 #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316 #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174 #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696 #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926 #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820 #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249 #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132 #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit 627a785)

If the connection is closed by the client the ongoing tevent_req must be cancelled, otherwise winbindd receives a SIGBUS when trying to write in the closed stream. [2023/02/08 12:56:41.308393, 0] ../../lib/util/fault.c:173(smb_panic_log) =============================================================== [2023/02/08 12:56:41.308438, 0] ../../lib/util/fault.c:174(smb_panic_log) INTERNAL ERROR: Signal 7: Bus error in pid 24407 (4.19.0pre1-DEVELOPERBUILD) [2023/02/08 12:56:41.308451, 0] ../../lib/util/fault.c:178(smb_panic_log) If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting [2023/02/08 12:56:41.308463, 0] ../../lib/util/fault.c:183(smb_panic_log) =============================================================== [2023/02/08 12:56:41.308473, 0] ../../lib/util/fault.c:184(smb_panic_log) PANIC (pid 24407): Signal 7: Bus error in 4.19.0pre1-DEVELOPERBUILD Backtrace: #0 0x00007f0e76853997 in wait4 () from /lib64/libc.so.6 #1 0x00007f0e767c591b in do_system () from /lib64/libc.so.6 #2 0x00007f0e7785ce43 in smb_panic_s3 (why=0x7ffe41b4e110 "Signal 7: Bus error") at ../../source3/lib/util.c:698 #3 0x00007f0e76ce59f1 in smb_panic (why=0x7ffe41b4e110 "Signal 7: Bus error") at ../../lib/util/fault.c:198 #4 0x00007f0e76ce54d0 in fault_report (sig=7) at ../../lib/util/fault.c:82 #5 0x00007f0e76ce54e5 in sig_fault (sig=7) at ../../lib/util/fault.c:93 #6 <signal handler called> #7 varlink_stream_write (stream=0x656d614e72657375, message=<optimized out>) at ../lib/stream.c:303 #8 0x00007f0e76c5aa35 in varlink_call_reply (call=0x561c51aafe60, parameters=<optimized out>, flags=1) at ../lib/service.c:651 #9 0x0000561c506a7e5b in membership_reply (call=0x561c51aafe60, username=0x561c51aaa860 "AFOREST+buser1", groupname=0x561c51acae58 "AFOREST+bgroup453", continues=true) at ../../source3/winbindd/winbindd_varlink_getmemberships.c:36 #10 0x0000561c506a9793 in memberships_by_user_getgrgid_done (req=0x0) at ../../source3/winbindd/winbindd_varlink_getmemberships.c:481 #11 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab2d30, location=0x561c5075b870 "../../source3/winbindd/winbindd_getgrgid.c:110") at ../../lib/tevent/tevent_req.c:151 #12 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab2d30, state=TEVENT_REQ_DONE, location=0x561c5075b870 "../../source3/winbindd/winbindd_getgrgid.c:110") at ../../lib/tevent/tevent_req.c:203 #13 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab2d30, location=0x561c5075b870 "../../source3/winbindd/winbindd_getgrgid.c:110") at ../../lib/tevent/tevent_req.c:209 #14 0x0000561c50713770 in winbindd_getgrgid_done (subreq=0x0) at ../../source3/winbindd/winbindd_getgrgid.c:110 #15 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51a98c50, location=0x561c507559b0 "../../source3/winbindd/wb_getgrsid.c:201") at ../../lib/tevent/tevent_req.c:151 #16 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51a98c50, state=TEVENT_REQ_DONE, location=0x561c507559b0 "../../source3/winbindd/wb_getgrsid.c:201") at ../../lib/tevent/tevent_req.c:203 #17 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51a98c50, location=0x561c507559b0 "../../source3/winbindd/wb_getgrsid.c:201") at ../../lib/tevent/tevent_req.c:209 #18 0x0000561c50708d22 in wb_getgrsid_got_members (subreq=0x0) at ../../source3/winbindd/wb_getgrsid.c:201 #19 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aa9e80, location=0x561c50755310 "../../source3/winbindd/wb_group_members.c:463") at ../../lib/tevent/tevent_req.c:151 #20 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aa9e80, state=TEVENT_REQ_DONE, location=0x561c50755310 "../../source3/winbindd/wb_group_members.c:463") at ../../lib/tevent/tevent_req.c:203 #21 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aa9e80, location=0x561c50755310 "../../source3/winbindd/wb_group_members.c:463") at ../../lib/tevent/tevent_req.c:209 #22 0x0000561c507082a6 in wb_group_members_done (subreq=0x0) at ../../source3/winbindd/wb_group_members.c:463 #23 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab1e00, location=0x561c50754f18 "../../source3/winbindd/wb_group_members.c:252") at ../../lib/tevent/tevent_req.c:151 #24 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab1e00, state=TEVENT_REQ_DONE, location=0x561c50754f18 "../../source3/winbindd/wb_group_members.c:252") at ../../lib/tevent/tevent_req.c:203 #25 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab1e00, location=0x561c50754f18 "../../source3/winbindd/wb_group_members.c:252") at ../../lib/tevent/tevent_req.c:209 #26 0x0000561c50707903 in wb_groups_members_done (subreq=0x0) at ../../source3/winbindd/wb_group_members.c:252 #27 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aafad0, location=0x561c50754bf0 "../../source3/winbindd/wb_group_members.c:102") at ../../lib/tevent/tevent_req.c:151 #28 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aafad0, state=TEVENT_REQ_DONE, location=0x561c50754bf0 "../../source3/winbindd/wb_group_members.c:102") at ../../lib/tevent/tevent_req.c:203 #29 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aafad0, location=0x561c50754bf0 "../../source3/winbindd/wb_group_members.c:102") at ../../lib/tevent/tevent_req.c:209 #30 0x0000561c5070732e in wb_lookupgroupmem_done (subreq=0x0) at ../../source3/winbindd/wb_group_members.c:102 #31 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab66a0, location=0x7f0e77bc5f18 "librpc/gen_ndr/ndr_winbind_c.c:2888") at ../../lib/tevent/tevent_req.c:151 #32 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab66a0, state=TEVENT_REQ_DONE, location=0x7f0e77bc5f18 "librpc/gen_ndr/ndr_winbind_c.c:2888") at ../../lib/tevent/tevent_req.c:203 #33 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab66a0, location=0x7f0e77bc5f18 "librpc/gen_ndr/ndr_winbind_c.c:2888") at ../../lib/tevent/tevent_req.c:209 #34 0x00007f0e77bba4a7 in dcerpc_wbint_LookupGroupMembers_done (subreq=0x0) at librpc/gen_ndr/ndr_winbind_c.c:2888 #35 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aa1dc0, location=0x7f0e77bc5d28 "librpc/gen_ndr/ndr_winbind_c.c:2773") at ../../lib/tevent/tevent_req.c:151 #36 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aa1dc0, state=TEVENT_REQ_DONE, location=0x7f0e77bc5d28 "librpc/gen_ndr/ndr_winbind_c.c:2773") at ../../lib/tevent/tevent_req.c:203 #37 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aa1dc0, location=0x7f0e77bc5d28 "librpc/gen_ndr/ndr_winbind_c.c:2773") at ../../lib/tevent/tevent_req.c:209 #38 0x00007f0e77bba0ef in dcerpc_wbint_LookupGroupMembers_r_done (subreq=0x0) at librpc/gen_ndr/ndr_winbind_c.c:2773 #39 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab51f0, location=0x7f0e7810b4d0 "../../librpc/rpc/binding_handle.c:520") at ../../lib/tevent/tevent_req.c:151 #40 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab51f0, state=TEVENT_REQ_DONE, location=0x7f0e7810b4d0 "../../librpc/rpc/binding_handle.c:520") at ../../lib/tevent/tevent_req.c:203 #41 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab51f0, location=0x7f0e7810b4d0 "../../librpc/rpc/binding_handle.c:520") at ../../lib/tevent/tevent_req.c:209 #42 0x00007f0e780f6bec in dcerpc_binding_handle_call_done (subreq=0x0) at ../../librpc/rpc/binding_handle.c:520 #43 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aaacf0, location=0x7f0e7810b090 "../../librpc/rpc/binding_handle.c:203") at ../../lib/tevent/tevent_req.c:151 #44 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aaacf0, state=TEVENT_REQ_DONE, location=0x7f0e7810b090 "../../librpc/rpc/binding_handle.c:203") at ../../lib/tevent/tevent_req.c:203 #45 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aaacf0, location=0x7f0e7810b090 "../../librpc/rpc/binding_handle.c:203") at ../../lib/tevent/tevent_req.c:209 #46 0x00007f0e780f60d2 in dcerpc_binding_handle_raw_call_done (subreq=0x0) at ../../librpc/rpc/binding_handle.c:203 #47 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab78b0, location=0x561c50745ef0 "../../source3/winbindd/winbindd_dual_ndr.c:209") at ../../lib/tevent/tevent_req.c:151 #48 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab78b0, state=TEVENT_REQ_DONE, location=0x561c50745ef0 "../../source3/winbindd/winbindd_dual_ndr.c:209") at ../../lib/tevent/tevent_req.c:203 #49 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab78b0, location=0x561c50745ef0 "../../source3/winbindd/winbindd_dual_ndr.c:209") at ../../lib/tevent/tevent_req.c:209 #50 0x0000561c506e7782 in wbint_bh_raw_call_domain_done (subreq=0x0) at ../../source3/winbindd/winbindd_dual_ndr.c:209 #51 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51a98750, location=0x561c50743390 "../../source3/winbindd/winbindd_dual.c:745") at ../../lib/tevent/tevent_req.c:151 #52 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51a98750, state=TEVENT_REQ_DONE, location=0x561c50743390 "../../source3/winbindd/winbindd_dual.c:745") at ../../lib/tevent/tevent_req.c:203 #53 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51a98750, location=0x561c50743390 "../../source3/winbindd/winbindd_dual.c:745") at ../../lib/tevent/tevent_req.c:209 #54 0x0000561c506e30d3 in wb_domain_request_done (subreq=0x0) at ../../source3/winbindd/winbindd_dual.c:745 #55 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab1a90, location=0x561c507429f8 "../../source3/winbindd/winbindd_dual.c:306") at ../../lib/tevent/tevent_req.c:151 #56 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab1a90, state=TEVENT_REQ_DONE, location=0x561c507429f8 "../../source3/winbindd/winbindd_dual.c:306") at ../../lib/tevent/tevent_req.c:203 #57 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab1a90, location=0x561c507429f8 "../../source3/winbindd/winbindd_dual.c:306") at ../../lib/tevent/tevent_req.c:209 #58 0x0000561c506e1f8d in wb_child_request_done (subreq=0x561c51ab3ca0) at ../../source3/winbindd/winbindd_dual.c:306 #59 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab3ca0, location=0x561c50723d98 "../../nsswitch/wb_reqtrans.c:432") at ../../lib/tevent/tevent_req.c:151 #60 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab3ca0, state=TEVENT_REQ_DONE, location=0x561c50723d98 "../../nsswitch/wb_reqtrans.c:432") at ../../lib/tevent/tevent_req.c:203 #61 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab3ca0, location=0x561c50723d98 "../../nsswitch/wb_reqtrans.c:432") at ../../lib/tevent/tevent_req.c:209 #62 0x0000561c50696101 in wb_simple_trans_read_done (subreq=0x0) at ../../nsswitch/wb_reqtrans.c:432 #63 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab6a20, location=0x561c50723a20 "../../nsswitch/wb_reqtrans.c:275") at ../../lib/tevent/tevent_req.c:151 #64 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab6a20, state=TEVENT_REQ_DONE, location=0x561c50723a20 "../../nsswitch/wb_reqtrans.c:275") at ../../lib/tevent/tevent_req.c:203 #65 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab6a20, location=0x561c50723a20 "../../nsswitch/wb_reqtrans.c:275") at ../../lib/tevent/tevent_req.c:209 #66 0x0000561c50695adf in wb_resp_read_done (subreq=0x0) at ../../nsswitch/wb_reqtrans.c:275 #67 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab6d70, location=0x7f0e7786fec8 "../../lib/async_req/async_sock.c:568") at ../../lib/tevent/tevent_req.c:151 #68 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab6d70, state=TEVENT_REQ_DONE, location=0x7f0e7786fec8 "../../lib/async_req/async_sock.c:568") at ../../lib/tevent/tevent_req.c:203 #69 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab6d70, location=0x7f0e7786fec8 "../../lib/async_req/async_sock.c:568") at ../../lib/tevent/tevent_req.c:209 #70 0x00007f0e778255eb in read_packet_handler (ev=0x561c51a86670, fde=0x561c51b982a0, flags=1, private_data=0x561c51ab6d70) at ../../lib/async_req/async_sock.c:568 #71 0x00007f0e780c9651 in tevent_common_invoke_fd_handler (fde=0x561c51b982a0, flags=1, removed=0x0) at ../../lib/tevent/tevent_fd.c:142 #72 0x00007f0e780d448c in epoll_event_loop (epoll_ev=0x561c51a96380, tvalp=0x7ffe41b4f6f0) at ../../lib/tevent/tevent_epoll.c:737 #73 0x00007f0e780d4aec in epoll_event_loop_once (ev=0x561c51a86670, location=0x561c50726a70 "../../source3/winbindd/winbindd.c:1734") at ../../lib/tevent/tevent_epoll.c:938 #74 0x00007f0e780d1408 in std_event_loop_once (ev=0x561c51a86670, location=0x561c50726a70 "../../source3/winbindd/winbindd.c:1734") at ../../lib/tevent/tevent_standard.c:110 #75 0x00007f0e780c8239 in _tevent_loop_once (ev=0x561c51a86670, location=0x561c50726a70 "../../source3/winbindd/winbindd.c:1734") at ../../lib/tevent/tevent.c:823 #76 0x0000561c5069c4a3 in main (argc=1, argv=0x7ffe41b4fb28) at ../../source3/winbindd/winbindd.c:1734 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>

Fix a deadlock that can happen if two clients happen to open and byte-range-lock two different files whos record in locking.tdb and brlock.tdb happen to sit on the same hashchain. The deadlock was introduced by commit 680c790. Before, we used share_mode_do_locked() in do_lock() which meant we acquired a chainlock on locking.tdb before getting a chainlock on brlock.tdb via brl_get_locks_for_locking(), so the TDB chainlock order invariant was always uphold. The following race between specific client requests lead to the deadlock. Client A) issues a byte-range-lock request on a file: A1) glock locking.tdb (via _share_mode_do_locked_vfs_allowed()) A2) chainlock brlock.tdb (via brl_lock()) A3) attempt to chainlock locking.tdb (via share_mode_g_lock_dump()) [1] Client B) opens a different (!) file: B1) glock and chainlock locking.tdb (via _share_mode_entry_prepare_lock()) B2) attempt to chainlock brlock.tdb (via file_has_brlocks()) [2] The glock from A1 is per record and hence doesn't synchronize with the glock from B1 as it is for a different file and hence a different record, subsequently A2 and A3 violate the lock order constraint To avoid the chainlock lock order violation in the second client we modify the br-lock code to not take the brlock.tdb chainlock from step A2 via br_get_locks() for the whole time we process the request. Instead we just fetch the br-locks via br_get_locks_readonly(), so when running into contend_level2_oplocks_begin_default() to check for leases and looking into locking.tdb we don't hold a brlock.tdb chainlock. Or im simpler terms, we only ever take at most one low-level TDB chainlock at a time: Byte-range-lock code calls share_mode_do_locked_brl(..., cb_fn, ...): 1) chainlock locking.tdb 2) glock locking.tdb (via share_mode_do_locked_vfs_allowed()) 3) chainunlock locking.tdb 4) share_mode_do_locked_brl_fn() -> brl_get_locks_readonly_parse(): a) chainlock brlock.tdb b) parse record and store in-memory copy c) chainunlock brlock.tdb 5) run cb_fn() 6) chainlock brlock.tdb: a) br_lck->record = dbwrap_fetch_locked(brlock_db, ...) b) store modifed br_lck from 5) via byte_range_lock_flush() 7) chainunlock brlock.tdb 8) chainlock locking.tdb 9) gunlock locking.tdb 10) chainunlock locking.tdb All access to brlock.tdb is synchronized correctly via glocks on the locking.tdb record of the file (step 3)), so operations still appear atomic to clients. As a result of using share_mode_do_locked_brl(), the functions do_[un]lock() -> brl_[un]lock() now loop over the same br_lck object in memory, avoiding repeatedly fetching and storing the locks per loop. [1] Full SBT: #0 0x00007fffa0cecbb0 in __pthread_mutex_lock_full () from /lib64/glibc-hwcaps/power9/libpthread-2.28.so #1 0x00007fffa0a73cf8 in chain_mutex_lock (m=<optimized out>, m@entry=0x7fff9ae071b0, waitflag=<optimized out>, waitflag@entry=true) at ../../lib/tdb/common/mutex.c:182 #2 0x00007fffa0a7432c in tdb_mutex_lock (tdb=0x1543ba120, rw=<optimized out>, off=<optimized out>, len=<optimized out>, waitflag=<optimized out>, pret=0x7fffd7df3858) at ../../lib/tdb/common/mutex.c:234 #3 0x00007fffa0a6812c in fcntl_lock (waitflag=<optimized out>, len=1, off=376608, rw=0, tdb=0x1543ba120) at ../../lib/tdb/common/lock.c:200 #4 tdb_brlock (tdb=0x1543ba120, rw_type=<optimized out>, offset=<optimized out>, len=1, flags=<optimized out>) at ../../lib/tdb/common/lock.c:200 #5 0x00007fffa0a68af8 in tdb_nest_lock (flags=<optimized out>, ltype=0, offset=<optimized out>, tdb=0x1543ba120) at ../../lib/tdb/common/lock.c:390 #6 tdb_nest_lock (tdb=0x1543ba120, offset=<optimized out>, ltype=<optimized out>, flags=<optimized out>) at ../../lib/tdb/common/lock.c:336 #7 0x00007fffa0a69088 in tdb_lock_list (tdb=0x1543ba120, list=<optimized out>, ltype=<optimized out>, waitflag=<optimized out>) at ../../lib/tdb/common/lock.c:482 #8 0x00007fffa0a69198 in tdb_lock (tdb=0x1543ba120, list=<optimized out>, ltype=<optimized out>) at ../../lib/tdb/common/lock.c:500 #9 0x00007fffa0a64b50 in tdb_find_lock_hash (tdb=<optimized out>, tdb@entry=0x1543ba120, key=..., hash=<optimized out>, locktype=<optimized out>, locktype@entry=0, rec=<optimized out>, rec@entry=0x7fffd7df3ab0) at ../../lib/tdb/common/tdb.c:165 #10 0x00007fffa0a64ed0 in tdb_parse_record (tdb=0x1543ba120, key=..., parser=0x7fffa0e74470 <db_ctdb_ltdb_parser>, private_data=0x7fffd7df3b18) at ../../lib/tdb/common/tdb.c:329 #11 0x00007fffa0e74cbc in db_ctdb_ltdb_parse (db=<optimized out>, private_data=0x7fffd7df3b70, parser=0x7fffa0e76470 <db_ctdb_parse_record_parser_nonpersistent>, key=...) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:170 #12 db_ctdb_try_parse_local_record (ctx=ctx@entry=0x1543d4580, key=..., state=state@entry=0x7fffd7df3b70) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1385 #13 0x00007fffa0e76024 in db_ctdb_parse_record (db=<optimized out>, key=..., parser=0x7fffa1313910 <dbwrap_watched_parse_record_parser>, private_data=0x7fffd7df3c08) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1425 #14 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #15 0x00007fffa1313ab4 in dbwrap_watched_parse_record (db=0x1543a7160, key=..., parser=0x7fffa13187d0 <g_lock_dump_fn>, private_data=0x7fffd7df3ce8) at ../../source3/lib/dbwrap/dbwrap_watch.c:783 #16 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #17 0x00007fffa131c004 in g_lock_dump (ctx=<error reading variable: value has been optimized out>, key=..., fn=0x7fffa14f3d70 <fsp_update_share_mode_flags_fn>, private_data=0x7fffd7df3dd8) at ../../source3/lib/g_lock.c:1653 #18 0x00007fffa14f434c in share_mode_g_lock_dump (key=..., fn=0x7fffa14f3d70 <fsp_update_share_mode_flags_fn>, private_data=0x7fffd7df3dd8) at ../../source3/locking/share_mode_lock.c:96 #19 0x00007fffa14f8d44 in fsp_update_share_mode_flags (fsp=0x15433c550) at ../../source3/locking/share_mode_lock.c:1181 #20 file_has_read_lease (fsp=0x15433c550) at ../../source3/locking/share_mode_lock.c:1207 #21 0x00007fffa15ccc98 in contend_level2_oplocks_begin_default (type=<optimized out>, fsp=0x15433c550) at ../../source3/smbd/smb2_oplock.c:1282 #22 smbd_contend_level2_oplocks_begin (fsp=0x15433c550, type=<optimized out>) at ../../source3/smbd/smb2_oplock.c:1338 #23 0x00007fffa0dd0b54 in contend_level2_oplocks_begin (fsp=<optimized out>, type=<optimized out>) at ../../source3/lib/smbd_shim.c:72 #24 0x00007fffa14ecfd0 in brl_lock_windows_default (br_lck=0x154421330, plock=0x7fffd7df4250) at ../../source3/locking/brlock.c:457 #25 0x00007fffa150b70c in vfswrap_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/modules/vfs_default.c:3424 #26 0x00007fffa1561910 in smb_vfs_call_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/smbd/vfs.c:2686 #27 0x00007fff9c0a7350 in smb_time_audit_brl_lock_windows (handle=<optimized out>, br_lck=0x154421330, plock=0x7fffd7df4250) at ../../source3/modules/vfs_time_audit.c:1740 #28 0x00007fffa1561910 in smb_vfs_call_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/smbd/vfs.c:2686 #29 0x00007fffa14ed410 in brl_lock (br_lck=0x154421330, smblctx=3102281601, pid=..., start=0, size=18446744073709551615, lock_type=<optimized out>, lock_flav=WINDOWS_LOCK, blocker_pid=0x7fffd7df4540, psmblctx=0x7fffd7df4558) at ../../source3/locking/brlock.c:1004 #30 0x00007fffa14e7b18 in do_lock_fn (lck=<optimized out>, private_data=0x7fffd7df4508) at ../../source3/locking/locking.c:271 #31 0x00007fffa14fcd94 in _share_mode_do_locked_vfs_allowed (id=..., fn=0x7fffa14e7a60 <do_lock_fn>, private_data=0x7fffd7df4508, location=<optimized out>) at ../../source3/locking/share_mode_lock.c:2927 #32 0x00007fffa14e918c in do_lock (fsp=0x15433c550, req_mem_ctx=<optimized out>, req_guid=<optimized out>, smblctx=<optimized out>, count=18446744073709551615, offset=0, lock_type=<optimized out>, lock_flav=<optimized out>, pblocker_pid=0x7fffd7df46f0, psmblctx=0x7fffd7df46d8) at ../../source3/locking/locking.c:335 #33 0x00007fffa155381c in smbd_do_locks_try (fsp=0x15433c550, num_locks=<optimized out>, locks=0x1543bc310, blocker_idx=0x7fffd7df46d6, blocking_pid=0x7fffd7df46f0, blocking_smblctx=0x7fffd7df46d8) at ../../source3/smbd/blocking.c:46 #34 0x00007fffa159dc90 in smbd_smb2_lock_try (req=req@entry=0x1543bc080) at ../../source3/smbd/smb2_lock.c:590 #35 0x00007fffa159ee8c in smbd_smb2_lock_send (in_locks=<optimized out>, in_lock_count=1, in_lock_sequence=<optimized out>, fsp=0x15433c550, smb2req=0x1543532e0, ev=0x154328120, mem_ctx=0x1543532e0) at ../../source3/smbd/smb2_lock.c:488 #36 smbd_smb2_request_process_lock (req=0x1543532e0) at ../../source3/smbd/smb2_lock.c:150 #37 0x00007fffa158a368 in smbd_smb2_request_dispatch (req=0x1543532e0) at ../../source3/smbd/smb2_server.c:3515 #38 0x00007fffa158c540 in smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x154313f30) at ../../source3/smbd/smb2_server.c:5112 #39 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:5150 #40 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543670f0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #41 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4b28, epoll_ev=0x1543b4e80) at ../../lib/tevent/tevent_epoll.c:730 #42 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #43 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:110 #44 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent.c:823 #45 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #46 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:141 #47 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #48 0x00007fffa15737fc in smbd_process (ev_ctx=0x154328120, msg_ctx=<optimized out>, sock_fd=<optimized out>, interactive=<optimized out>) at ../../source3/smbd/smb2_process.c:2158 #49 0x000000011db5c554 in smbd_accept_connection (ev=0x154328120, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1150 #50 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543ac2d0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #51 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4f98, epoll_ev=0x154328350) at ../../lib/tevent/tevent_epoll.c:730 #52 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #53 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:110 #54 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent.c:823 #55 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #56 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:141 #57 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #58 0x000000011db58c54 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x154328120) at ../../source3/smbd/server.c:1499 #59 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2258 [2] Full SBT: #0 0x00007fffa0cecbb0 in __pthread_mutex_lock_full () from /lib64/glibc-hwcaps/power9/libpthread-2.28.so #1 0x00007fffa0a73cf8 in chain_mutex_lock (m=<optimized out>, m@entry=0x7fff9b3a71b0, waitflag=<optimized out>, waitflag@entry=true) at ../../lib/tdb/common/mutex.c:182 #2 0x00007fffa0a7432c in tdb_mutex_lock (tdb=0x1543c6900, rw=<optimized out>, off=<optimized out>, len=<optimized out>, waitflag=<optimized out>, pret=0x7fffd7df2e28) at ../../lib/tdb/common/mutex.c:234 #3 0x00007fffa0a6812c in fcntl_lock (waitflag=<optimized out>, len=1, off=376608, rw=0, tdb=0x1543c6900) at ../../lib/tdb/common/lock.c:200 #4 tdb_brlock (tdb=0x1543c6900, rw_type=<optimized out>, offset=<optimized out>, len=1, flags=<optimized out>) at ../../lib/tdb/common/lock.c:200 #5 0x00007fffa0a68af8 in tdb_nest_lock (flags=<optimized out>, ltype=0, offset=<optimized out>, tdb=0x1543c6900) at ../../lib/tdb/common/lock.c:390 #6 tdb_nest_lock (tdb=0x1543c6900, offset=<optimized out>, ltype=<optimized out>, flags=<optimized out>) at ../../lib/tdb/common/lock.c:336 #7 0x00007fffa0a69088 in tdb_lock_list (tdb=0x1543c6900, list=<optimized out>, ltype=<optimized out>, waitflag=<optimized out>) at ../../lib/tdb/common/lock.c:482 #8 0x00007fffa0a69198 in tdb_lock (tdb=0x1543c6900, list=<optimized out>, ltype=<optimized out>) at ../../lib/tdb/common/lock.c:500 #9 0x00007fffa0a64b50 in tdb_find_lock_hash (tdb=<optimized out>, tdb@entry=0x1543c6900, key=..., hash=<optimized out>, locktype=<optimized out>, locktype@entry=0, rec=<optimized out>, rec@entry=0x7fffd7df3080) at ../../lib/tdb/common/tdb.c:165 #10 0x00007fffa0a64ed0 in tdb_parse_record (tdb=0x1543c6900, key=..., parser=0x7fffa0e74470 <db_ctdb_ltdb_parser>, private_data=0x7fffd7df30e8) at ../../lib/tdb/common/tdb.c:329 #11 0x00007fffa0e74cbc in db_ctdb_ltdb_parse (db=<optimized out>, private_data=0x7fffd7df3140, parser=0x7fffa0e76470 <db_ctdb_parse_record_parser_nonpersistent>, key=...) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:170 #12 db_ctdb_try_parse_local_record (ctx=ctx@entry=0x154328fc0, key=..., state=state@entry=0x7fffd7df3140) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1385 #13 0x00007fffa0e76024 in db_ctdb_parse_record (db=<optimized out>, key=..., parser=0x7fffa14ec820 <brl_get_locks_readonly_parser>, private_data=0x7fffd7df3218) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1425 #14 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #15 0x00007fffa14ef5bc in brl_get_locks_readonly (fsp=0x1543d01e0) at ../../source3/locking/brlock.c:1884 #16 0x00007fffa1546968 in file_has_brlocks (fsp=0x1543d01e0) at ../../source3/smbd/open.c:2232 #17 delay_for_oplock (pgranted=<synthetic pointer>, poplock_type=<synthetic pointer>, first_open_attempt=<optimized out>, create_disposition=1, have_sharing_violation=false, lck=0x7fffd7df3ce8, lease=0x0, oplock_request=0, fsp=0x1543d01e0) at ../../source3/smbd/open.c:2749 #18 handle_share_mode_lease (pgranted=<synthetic pointer>, poplock_type=<synthetic pointer>, first_open_attempt=<optimized out>, lease=0x0, oplock_request=0, share_access=7, access_mask=131201, create_disposition=1, lck=0x7fffd7df3ce8, fsp=0x1543d01e0) at ../../source3/smbd/open.c:2865 #19 check_and_store_share_mode (first_open_attempt=<optimized out>, lease=0x0, oplock_request=0, share_access=7, access_mask=131201, create_disposition=1, lck=0x7fffd7df3ce8, req=0x154414800, fsp=0x1543d01e0) at ../../source3/smbd/open.c:3333 #20 open_ntcreate_lock_add_entry (lck=0x7fffd7df3ce8, keep_locked=0x7fffd7df3ad0, private_data=0x7fffd7df3cc8) at ../../source3/smbd/open.c:3688 #21 0x00007fffa14f6248 in share_mode_entry_prepare_lock_fn (glck=0x7fffd7df35b8, cb_private=0x7fffd7df3a88) at ../../source3/locking/share_mode_lock.c:2978 #22 0x00007fffa1317680 in g_lock_lock_cb_run_and_store (cb_state=cb_state@entry=0x7fffd7df35b8) at ../../source3/lib/g_lock.c:597 #23 0x00007fffa1319df8 in g_lock_lock_simple_fn (rec=0x7fffd7df3798, value=..., private_data=0x7fffd7df39a0) at ../../source3/lib/g_lock.c:1212 #24 0x00007fffa13160e0 in dbwrap_watched_do_locked_fn (backend_rec=<optimized out>, backend_value=..., private_data=0x7fffd7df3768) at ../../source3/lib/dbwrap/dbwrap_watch.c:458 #25 0x00007fffa0884e48 in dbwrap_do_locked (db=<optimized out>, key=..., fn=0x7fffa1316080 <dbwrap_watched_do_locked_fn>, private_data=0x7fffd7df3768) at ../../lib/dbwrap/dbwrap.c:602 #26 0x00007fffa1315274 in dbwrap_watched_do_locked (db=0x1543a7160, key=..., fn=0x7fffa1319ca0 <g_lock_lock_simple_fn>, private_data=0x7fffd7df39a0) at ../../source3/lib/dbwrap/dbwrap_watch.c:480 #27 0x00007fffa0884d60 in dbwrap_do_locked (db=<optimized out>, key=..., fn=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:582 #28 0x00007fffa131b458 in g_lock_lock (ctx=0x1543cc630, key=..., type=<optimized out>, timeout=..., cb_fn=0x7fffa14f6190 <share_mode_entry_prepare_lock_fn>, cb_private=0x7fffd7df3a88) at ../../source3/lib/g_lock.c:1267 #29 0x00007fffa14fd060 in _share_mode_entry_prepare_lock (prepare_state=0x7fffd7df3cc8, id=..., servicepath=<optimized out>, smb_fname=<optimized out>, old_write_time=<optimized out>, fn=<optimized out>, private_data=0x7fffd7df3cc8, location=0x7fffa165b880 "../../source3/smbd/open.c:4292") at ../../source3/locking/share_mode_lock.c:3033 #30 0x00007fffa15491e0 in open_file_ntcreate (conn=conn@entry=0x154382050, req=req@entry=0x154414800, access_mask=<optimized out>, access_mask@entry=131201, share_access=share_access@entry=7, create_disposition=create_disposition@entry=1, create_options=create_options@entry=0, new_dos_attributes=<optimized out>, new_dos_attributes@entry=128, oplock_request=oplock_request@entry=0, lease=<optimized out>, lease@entry=0x0, private_flags=<optimized out>, private_flags@entry=0, parent_dir_fname=<optimized out>, smb_fname_atname=<optimized out>, pinfo=<optimized out>, pinfo@entry=0x7fffd7df3f1c, fsp=<optimized out>, fsp@entry=0x1543d01e0) at ../../source3/smbd/open.c:4286 #31 0x00007fffa154b94c in create_file_unixpath (conn=conn@entry=0x154382050, req=req@entry=0x154414800, dirfsp=dirfsp@entry=0x15439a7f0, smb_fname=smb_fname@entry=0x154416300, access_mask=access_mask@entry=131201, share_access=share_access@entry=7, create_disposition=create_disposition@entry=1, create_options=create_options@entry=0, file_attributes=file_attributes@entry=128, oplock_request=<optimized out>, oplock_request@entry=0, lease=<optimized out>, lease@entry=0x0, allocation_size=allocation_size@entry=0, private_flags=private_flags@entry=0, sd=sd@entry=0x0, ea_list=ea_list@entry=0x0, result=result@entry=0x7fffd7df4168, pinfo=pinfo@entry=0x7fffd7df4160) at ../../source3/smbd/open.c:6290 #32 0x00007fffa154dfac in create_file_default (conn=0x154382050, req=0x154414800, dirfsp=0x15439a7f0, smb_fname=0x154416300, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/open.c:6609 #33 0x00007fffa150972c in vfswrap_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/modules/vfs_default.c:776 #34 0x00007fffa1559cbc in smb_vfs_call_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/vfs.c:1560 #35 0x00007fff9c0a9ec4 in smb_time_audit_create_file (handle=0x154426820, req=0x154414800, dirfsp=0x15439a7f0, fname=0x154416300, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result_fsp=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/modules/vfs_time_audit.c:634 #36 0x00007fffa1559cbc in smb_vfs_call_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/vfs.c:1560 #37 0x00007fffa1597aa8 in smbd_smb2_create_send (in_context_blobs=..., in_name=0x154413ca0, in_create_options=<optimized out>, in_create_disposition=<optimized out>, in_share_access=<optimized out>, in_file_attributes=<optimized out>, in_desired_access=<optimized out>, in_impersonation_level=<optimized out>, in_oplock_level=<optimized out>, smb2req=0x154413770, ev=0x154328120, mem_ctx=0x154413770) at ../../source3/smbd/smb2_create.c:1115 #38 smbd_smb2_request_process_create (smb2req=0x154413770) at ../../source3/smbd/smb2_create.c:291 #39 0x00007fffa158a628 in smbd_smb2_request_dispatch (req=0x154413770) at ../../source3/smbd/smb2_server.c:3485 #40 0x00007fffa158c540 in smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x154313f30) at ../../source3/smbd/smb2_server.c:5112 #41 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:5150 #42 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x15435add0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #43 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4b28, epoll_ev=0x1543b4e80) at ../../lib/tevent/tevent_epoll.c:730 #44 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #45 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:110 #46 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent.c:823 #47 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #48 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:141 #49 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #50 0x00007fffa15737fc in smbd_process (ev_ctx=0x154328120, msg_ctx=<optimized out>, sock_fd=<optimized out>, interactive=<optimized out>) at ../../source3/smbd/smb2_process.c:2158 #51 0x000000011db5c554 in smbd_accept_connection (ev=0x154328120, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1150 #52 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543ac2d0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #53 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4f98, epoll_ev=0x154328350) at ../../lib/tevent/tevent_epoll.c:730 #54 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #55 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:110 #56 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent.c:823 #57 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #58 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:141 #59 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #60 0x000000011db58c54 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x154328120) at ../../source3/smbd/server.c:1499 #61 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2258 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15767 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>

Fix a deadlock that can happen if two clients happen to open and byte-range-lock two different files whos record in locking.tdb and brlock.tdb happen to sit on the same hashchain. The deadlock was introduced by commit 680c790. Before, we used share_mode_do_locked() in do_lock() which meant we acquired a chainlock on locking.tdb before getting a chainlock on brlock.tdb via brl_get_locks_for_locking(), so the TDB chainlock order invariant was always uphold. The following race between specific client requests lead to the deadlock. Client A) issues a byte-range-lock request on a file: A1) glock locking.tdb (via _share_mode_do_locked_vfs_allowed()) A2) chainlock brlock.tdb (via brl_lock()) A3) attempt to chainlock locking.tdb (via share_mode_g_lock_dump()) [1] Client B) opens a different (!) file: B1) glock and chainlock locking.tdb (via _share_mode_entry_prepare_lock()) B2) attempt to chainlock brlock.tdb (via file_has_brlocks()) [2] The glock from A1 is per record and hence doesn't synchronize with the glock from B1 as it is for a different file and hence a different record, subsequently A2 and A3 violate the lock order constraint To avoid the chainlock lock order violation in the second client we modify the br-lock code to not take the brlock.tdb chainlock from step A2 via br_get_locks() for the whole time we process the request. Instead we just fetch the br-locks via br_get_locks_readonly(), so when running into contend_level2_oplocks_begin_default() to check for leases and looking into locking.tdb we don't hold a brlock.tdb chainlock. Or im simpler terms, we only ever take at most one low-level TDB chainlock at a time: Byte-range-lock code calls share_mode_do_locked_brl(..., cb_fn, ...): 1) chainlock locking.tdb 2) glock locking.tdb (via share_mode_do_locked_vfs_allowed()) 3) chainunlock locking.tdb 4) share_mode_do_locked_brl_fn() -> brl_get_locks_readonly_parse(): a) chainlock brlock.tdb b) parse record and store in-memory copy c) chainunlock brlock.tdb 5) run cb_fn() 6) chainlock brlock.tdb: a) br_lck->record = dbwrap_fetch_locked(brlock_db, ...) b) store modifed br_lck from 5) via byte_range_lock_flush() 7) chainunlock brlock.tdb 8) chainlock locking.tdb 9) gunlock locking.tdb 10) chainunlock locking.tdb All access to brlock.tdb is synchronized correctly via glocks on the locking.tdb record of the file (step 3)), so operations still appear atomic to clients. As a result of using share_mode_do_locked_brl(), the functions do_[un]lock() -> brl_[un]lock() now loop over the same br_lck object in memory, avoiding repeatedly fetching and storing the locks per loop. [1] Full SBT: #0 0x00007fffa0cecbb0 in __pthread_mutex_lock_full () from /lib64/glibc-hwcaps/power9/libpthread-2.28.so #1 0x00007fffa0a73cf8 in chain_mutex_lock (m=<optimized out>, m@entry=0x7fff9ae071b0, waitflag=<optimized out>, waitflag@entry=true) at ../../lib/tdb/common/mutex.c:182 #2 0x00007fffa0a7432c in tdb_mutex_lock (tdb=0x1543ba120, rw=<optimized out>, off=<optimized out>, len=<optimized out>, waitflag=<optimized out>, pret=0x7fffd7df3858) at ../../lib/tdb/common/mutex.c:234 #3 0x00007fffa0a6812c in fcntl_lock (waitflag=<optimized out>, len=1, off=376608, rw=0, tdb=0x1543ba120) at ../../lib/tdb/common/lock.c:200 #4 tdb_brlock (tdb=0x1543ba120, rw_type=<optimized out>, offset=<optimized out>, len=1, flags=<optimized out>) at ../../lib/tdb/common/lock.c:200 #5 0x00007fffa0a68af8 in tdb_nest_lock (flags=<optimized out>, ltype=0, offset=<optimized out>, tdb=0x1543ba120) at ../../lib/tdb/common/lock.c:390 #6 tdb_nest_lock (tdb=0x1543ba120, offset=<optimized out>, ltype=<optimized out>, flags=<optimized out>) at ../../lib/tdb/common/lock.c:336 #7 0x00007fffa0a69088 in tdb_lock_list (tdb=0x1543ba120, list=<optimized out>, ltype=<optimized out>, waitflag=<optimized out>) at ../../lib/tdb/common/lock.c:482 #8 0x00007fffa0a69198 in tdb_lock (tdb=0x1543ba120, list=<optimized out>, ltype=<optimized out>) at ../../lib/tdb/common/lock.c:500 #9 0x00007fffa0a64b50 in tdb_find_lock_hash (tdb=<optimized out>, tdb@entry=0x1543ba120, key=..., hash=<optimized out>, locktype=<optimized out>, locktype@entry=0, rec=<optimized out>, rec@entry=0x7fffd7df3ab0) at ../../lib/tdb/common/tdb.c:165 #10 0x00007fffa0a64ed0 in tdb_parse_record (tdb=0x1543ba120, key=..., parser=0x7fffa0e74470 <db_ctdb_ltdb_parser>, private_data=0x7fffd7df3b18) at ../../lib/tdb/common/tdb.c:329 #11 0x00007fffa0e74cbc in db_ctdb_ltdb_parse (db=<optimized out>, private_data=0x7fffd7df3b70, parser=0x7fffa0e76470 <db_ctdb_parse_record_parser_nonpersistent>, key=...) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:170 #12 db_ctdb_try_parse_local_record (ctx=ctx@entry=0x1543d4580, key=..., state=state@entry=0x7fffd7df3b70) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1385 #13 0x00007fffa0e76024 in db_ctdb_parse_record (db=<optimized out>, key=..., parser=0x7fffa1313910 <dbwrap_watched_parse_record_parser>, private_data=0x7fffd7df3c08) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1425 #14 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #15 0x00007fffa1313ab4 in dbwrap_watched_parse_record (db=0x1543a7160, key=..., parser=0x7fffa13187d0 <g_lock_dump_fn>, private_data=0x7fffd7df3ce8) at ../../source3/lib/dbwrap/dbwrap_watch.c:783 #16 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #17 0x00007fffa131c004 in g_lock_dump (ctx=<error reading variable: value has been optimized out>, key=..., fn=0x7fffa14f3d70 <fsp_update_share_mode_flags_fn>, private_data=0x7fffd7df3dd8) at ../../source3/lib/g_lock.c:1653 #18 0x00007fffa14f434c in share_mode_g_lock_dump (key=..., fn=0x7fffa14f3d70 <fsp_update_share_mode_flags_fn>, private_data=0x7fffd7df3dd8) at ../../source3/locking/share_mode_lock.c:96 #19 0x00007fffa14f8d44 in fsp_update_share_mode_flags (fsp=0x15433c550) at ../../source3/locking/share_mode_lock.c:1181 #20 file_has_read_lease (fsp=0x15433c550) at ../../source3/locking/share_mode_lock.c:1207 #21 0x00007fffa15ccc98 in contend_level2_oplocks_begin_default (type=<optimized out>, fsp=0x15433c550) at ../../source3/smbd/smb2_oplock.c:1282 #22 smbd_contend_level2_oplocks_begin (fsp=0x15433c550, type=<optimized out>) at ../../source3/smbd/smb2_oplock.c:1338 #23 0x00007fffa0dd0b54 in contend_level2_oplocks_begin (fsp=<optimized out>, type=<optimized out>) at ../../source3/lib/smbd_shim.c:72 #24 0x00007fffa14ecfd0 in brl_lock_windows_default (br_lck=0x154421330, plock=0x7fffd7df4250) at ../../source3/locking/brlock.c:457 #25 0x00007fffa150b70c in vfswrap_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/modules/vfs_default.c:3424 #26 0x00007fffa1561910 in smb_vfs_call_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/smbd/vfs.c:2686 #27 0x00007fff9c0a7350 in smb_time_audit_brl_lock_windows (handle=<optimized out>, br_lck=0x154421330, plock=0x7fffd7df4250) at ../../source3/modules/vfs_time_audit.c:1740 #28 0x00007fffa1561910 in smb_vfs_call_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/smbd/vfs.c:2686 #29 0x00007fffa14ed410 in brl_lock (br_lck=0x154421330, smblctx=3102281601, pid=..., start=0, size=18446744073709551615, lock_type=<optimized out>, lock_flav=WINDOWS_LOCK, blocker_pid=0x7fffd7df4540, psmblctx=0x7fffd7df4558) at ../../source3/locking/brlock.c:1004 #30 0x00007fffa14e7b18 in do_lock_fn (lck=<optimized out>, private_data=0x7fffd7df4508) at ../../source3/locking/locking.c:271 #31 0x00007fffa14fcd94 in _share_mode_do_locked_vfs_allowed (id=..., fn=0x7fffa14e7a60 <do_lock_fn>, private_data=0x7fffd7df4508, location=<optimized out>) at ../../source3/locking/share_mode_lock.c:2927 #32 0x00007fffa14e918c in do_lock (fsp=0x15433c550, req_mem_ctx=<optimized out>, req_guid=<optimized out>, smblctx=<optimized out>, count=18446744073709551615, offset=0, lock_type=<optimized out>, lock_flav=<optimized out>, pblocker_pid=0x7fffd7df46f0, psmblctx=0x7fffd7df46d8) at ../../source3/locking/locking.c:335 #33 0x00007fffa155381c in smbd_do_locks_try (fsp=0x15433c550, num_locks=<optimized out>, locks=0x1543bc310, blocker_idx=0x7fffd7df46d6, blocking_pid=0x7fffd7df46f0, blocking_smblctx=0x7fffd7df46d8) at ../../source3/smbd/blocking.c:46 #34 0x00007fffa159dc90 in smbd_smb2_lock_try (req=req@entry=0x1543bc080) at ../../source3/smbd/smb2_lock.c:590 #35 0x00007fffa159ee8c in smbd_smb2_lock_send (in_locks=<optimized out>, in_lock_count=1, in_lock_sequence=<optimized out>, fsp=0x15433c550, smb2req=0x1543532e0, ev=0x154328120, mem_ctx=0x1543532e0) at ../../source3/smbd/smb2_lock.c:488 #36 smbd_smb2_request_process_lock (req=0x1543532e0) at ../../source3/smbd/smb2_lock.c:150 #37 0x00007fffa158a368 in smbd_smb2_request_dispatch (req=0x1543532e0) at ../../source3/smbd/smb2_server.c:3515 #38 0x00007fffa158c540 in smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x154313f30) at ../../source3/smbd/smb2_server.c:5112 #39 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:5150 #40 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543670f0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #41 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4b28, epoll_ev=0x1543b4e80) at ../../lib/tevent/tevent_epoll.c:730 #42 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #43 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:110 #44 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent.c:823 #45 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #46 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:141 #47 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #48 0x00007fffa15737fc in smbd_process (ev_ctx=0x154328120, msg_ctx=<optimized out>, sock_fd=<optimized out>, interactive=<optimized out>) at ../../source3/smbd/smb2_process.c:2158 #49 0x000000011db5c554 in smbd_accept_connection (ev=0x154328120, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1150 #50 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543ac2d0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #51 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4f98, epoll_ev=0x154328350) at ../../lib/tevent/tevent_epoll.c:730 #52 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #53 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:110 #54 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent.c:823 #55 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #56 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:141 #57 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #58 0x000000011db58c54 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x154328120) at ../../source3/smbd/server.c:1499 #59 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2258 [2] Full SBT: #0 0x00007fffa0cecbb0 in __pthread_mutex_lock_full () from /lib64/glibc-hwcaps/power9/libpthread-2.28.so #1 0x00007fffa0a73cf8 in chain_mutex_lock (m=<optimized out>, m@entry=0x7fff9b3a71b0, waitflag=<optimized out>, waitflag@entry=true) at ../../lib/tdb/common/mutex.c:182 #2 0x00007fffa0a7432c in tdb_mutex_lock (tdb=0x1543c6900, rw=<optimized out>, off=<optimized out>, len=<optimized out>, waitflag=<optimized out>, pret=0x7fffd7df2e28) at ../../lib/tdb/common/mutex.c:234 #3 0x00007fffa0a6812c in fcntl_lock (waitflag=<optimized out>, len=1, off=376608, rw=0, tdb=0x1543c6900) at ../../lib/tdb/common/lock.c:200 #4 tdb_brlock (tdb=0x1543c6900, rw_type=<optimized out>, offset=<optimized out>, len=1, flags=<optimized out>) at ../../lib/tdb/common/lock.c:200 #5 0x00007fffa0a68af8 in tdb_nest_lock (flags=<optimized out>, ltype=0, offset=<optimized out>, tdb=0x1543c6900) at ../../lib/tdb/common/lock.c:390 #6 tdb_nest_lock (tdb=0x1543c6900, offset=<optimized out>, ltype=<optimized out>, flags=<optimized out>) at ../../lib/tdb/common/lock.c:336 #7 0x00007fffa0a69088 in tdb_lock_list (tdb=0x1543c6900, list=<optimized out>, ltype=<optimized out>, waitflag=<optimized out>) at ../../lib/tdb/common/lock.c:482 #8 0x00007fffa0a69198 in tdb_lock (tdb=0x1543c6900, list=<optimized out>, ltype=<optimized out>) at ../../lib/tdb/common/lock.c:500 #9 0x00007fffa0a64b50 in tdb_find_lock_hash (tdb=<optimized out>, tdb@entry=0x1543c6900, key=..., hash=<optimized out>, locktype=<optimized out>, locktype@entry=0, rec=<optimized out>, rec@entry=0x7fffd7df3080) at ../../lib/tdb/common/tdb.c:165 #10 0x00007fffa0a64ed0 in tdb_parse_record (tdb=0x1543c6900, key=..., parser=0x7fffa0e74470 <db_ctdb_ltdb_parser>, private_data=0x7fffd7df30e8) at ../../lib/tdb/common/tdb.c:329 #11 0x00007fffa0e74cbc in db_ctdb_ltdb_parse (db=<optimized out>, private_data=0x7fffd7df3140, parser=0x7fffa0e76470 <db_ctdb_parse_record_parser_nonpersistent>, key=...) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:170 #12 db_ctdb_try_parse_local_record (ctx=ctx@entry=0x154328fc0, key=..., state=state@entry=0x7fffd7df3140) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1385 #13 0x00007fffa0e76024 in db_ctdb_parse_record (db=<optimized out>, key=..., parser=0x7fffa14ec820 <brl_get_locks_readonly_parser>, private_data=0x7fffd7df3218) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1425 #14 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #15 0x00007fffa14ef5bc in brl_get_locks_readonly (fsp=0x1543d01e0) at ../../source3/locking/brlock.c:1884 #16 0x00007fffa1546968 in file_has_brlocks (fsp=0x1543d01e0) at ../../source3/smbd/open.c:2232 #17 delay_for_oplock (pgranted=<synthetic pointer>, poplock_type=<synthetic pointer>, first_open_attempt=<optimized out>, create_disposition=1, have_sharing_violation=false, lck=0x7fffd7df3ce8, lease=0x0, oplock_request=0, fsp=0x1543d01e0) at ../../source3/smbd/open.c:2749 #18 handle_share_mode_lease (pgranted=<synthetic pointer>, poplock_type=<synthetic pointer>, first_open_attempt=<optimized out>, lease=0x0, oplock_request=0, share_access=7, access_mask=131201, create_disposition=1, lck=0x7fffd7df3ce8, fsp=0x1543d01e0) at ../../source3/smbd/open.c:2865 #19 check_and_store_share_mode (first_open_attempt=<optimized out>, lease=0x0, oplock_request=0, share_access=7, access_mask=131201, create_disposition=1, lck=0x7fffd7df3ce8, req=0x154414800, fsp=0x1543d01e0) at ../../source3/smbd/open.c:3333 #20 open_ntcreate_lock_add_entry (lck=0x7fffd7df3ce8, keep_locked=0x7fffd7df3ad0, private_data=0x7fffd7df3cc8) at ../../source3/smbd/open.c:3688 #21 0x00007fffa14f6248 in share_mode_entry_prepare_lock_fn (glck=0x7fffd7df35b8, cb_private=0x7fffd7df3a88) at ../../source3/locking/share_mode_lock.c:2978 #22 0x00007fffa1317680 in g_lock_lock_cb_run_and_store (cb_state=cb_state@entry=0x7fffd7df35b8) at ../../source3/lib/g_lock.c:597 #23 0x00007fffa1319df8 in g_lock_lock_simple_fn (rec=0x7fffd7df3798, value=..., private_data=0x7fffd7df39a0) at ../../source3/lib/g_lock.c:1212 #24 0x00007fffa13160e0 in dbwrap_watched_do_locked_fn (backend_rec=<optimized out>, backend_value=..., private_data=0x7fffd7df3768) at ../../source3/lib/dbwrap/dbwrap_watch.c:458 #25 0x00007fffa0884e48 in dbwrap_do_locked (db=<optimized out>, key=..., fn=0x7fffa1316080 <dbwrap_watched_do_locked_fn>, private_data=0x7fffd7df3768) at ../../lib/dbwrap/dbwrap.c:602 #26 0x00007fffa1315274 in dbwrap_watched_do_locked (db=0x1543a7160, key=..., fn=0x7fffa1319ca0 <g_lock_lock_simple_fn>, private_data=0x7fffd7df39a0) at ../../source3/lib/dbwrap/dbwrap_watch.c:480 #27 0x00007fffa0884d60 in dbwrap_do_locked (db=<optimized out>, key=..., fn=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:582 #28 0x00007fffa131b458 in g_lock_lock (ctx=0x1543cc630, key=..., type=<optimized out>, timeout=..., cb_fn=0x7fffa14f6190 <share_mode_entry_prepare_lock_fn>, cb_private=0x7fffd7df3a88) at ../../source3/lib/g_lock.c:1267 #29 0x00007fffa14fd060 in _share_mode_entry_prepare_lock (prepare_state=0x7fffd7df3cc8, id=..., servicepath=<optimized out>, smb_fname=<optimized out>, old_write_time=<optimized out>, fn=<optimized out>, private_data=0x7fffd7df3cc8, location=0x7fffa165b880 "../../source3/smbd/open.c:4292") at ../../source3/locking/share_mode_lock.c:3033 #30 0x00007fffa15491e0 in open_file_ntcreate (conn=conn@entry=0x154382050, req=req@entry=0x154414800, access_mask=<optimized out>, access_mask@entry=131201, share_access=share_access@entry=7, create_disposition=create_disposition@entry=1, create_options=create_options@entry=0, new_dos_attributes=<optimized out>, new_dos_attributes@entry=128, oplock_request=oplock_request@entry=0, lease=<optimized out>, lease@entry=0x0, private_flags=<optimized out>, private_flags@entry=0, parent_dir_fname=<optimized out>, smb_fname_atname=<optimized out>, pinfo=<optimized out>, pinfo@entry=0x7fffd7df3f1c, fsp=<optimized out>, fsp@entry=0x1543d01e0) at ../../source3/smbd/open.c:4286 #31 0x00007fffa154b94c in create_file_unixpath (conn=conn@entry=0x154382050, req=req@entry=0x154414800, dirfsp=dirfsp@entry=0x15439a7f0, smb_fname=smb_fname@entry=0x154416300, access_mask=access_mask@entry=131201, share_access=share_access@entry=7, create_disposition=create_disposition@entry=1, create_options=create_options@entry=0, file_attributes=file_attributes@entry=128, oplock_request=<optimized out>, oplock_request@entry=0, lease=<optimized out>, lease@entry=0x0, allocation_size=allocation_size@entry=0, private_flags=private_flags@entry=0, sd=sd@entry=0x0, ea_list=ea_list@entry=0x0, result=result@entry=0x7fffd7df4168, pinfo=pinfo@entry=0x7fffd7df4160) at ../../source3/smbd/open.c:6290 #32 0x00007fffa154dfac in create_file_default (conn=0x154382050, req=0x154414800, dirfsp=0x15439a7f0, smb_fname=0x154416300, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/open.c:6609 #33 0x00007fffa150972c in vfswrap_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/modules/vfs_default.c:776 #34 0x00007fffa1559cbc in smb_vfs_call_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/vfs.c:1560 #35 0x00007fff9c0a9ec4 in smb_time_audit_create_file (handle=0x154426820, req=0x154414800, dirfsp=0x15439a7f0, fname=0x154416300, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result_fsp=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/modules/vfs_time_audit.c:634 #36 0x00007fffa1559cbc in smb_vfs_call_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/vfs.c:1560 #37 0x00007fffa1597aa8 in smbd_smb2_create_send (in_context_blobs=..., in_name=0x154413ca0, in_create_options=<optimized out>, in_create_disposition=<optimized out>, in_share_access=<optimized out>, in_file_attributes=<optimized out>, in_desired_access=<optimized out>, in_impersonation_level=<optimized out>, in_oplock_level=<optimized out>, smb2req=0x154413770, ev=0x154328120, mem_ctx=0x154413770) at ../../source3/smbd/smb2_create.c:1115 #38 smbd_smb2_request_process_create (smb2req=0x154413770) at ../../source3/smbd/smb2_create.c:291 #39 0x00007fffa158a628 in smbd_smb2_request_dispatch (req=0x154413770) at ../../source3/smbd/smb2_server.c:3485 #40 0x00007fffa158c540 in smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x154313f30) at ../../source3/smbd/smb2_server.c:5112 #41 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:5150 #42 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x15435add0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #43 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4b28, epoll_ev=0x1543b4e80) at ../../lib/tevent/tevent_epoll.c:730 #44 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #45 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:110 #46 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent.c:823 #47 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #48 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:141 #49 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #50 0x00007fffa15737fc in smbd_process (ev_ctx=0x154328120, msg_ctx=<optimized out>, sock_fd=<optimized out>, interactive=<optimized out>) at ../../source3/smbd/smb2_process.c:2158 #51 0x000000011db5c554 in smbd_accept_connection (ev=0x154328120, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1150 #52 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543ac2d0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #53 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4f98, epoll_ev=0x154328350) at ../../lib/tevent/tevent_epoll.c:730 #54 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #55 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:110 #56 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent.c:823 #57 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #58 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:141 #59 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #60 0x000000011db58c54 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x154328120) at ../../source3/smbd/server.c:1499 #61 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2258 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15767 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 2eef298)

Fix a deadlock that can happen if two clients happen to open and byte-range-lock two different files whos record in locking.tdb and brlock.tdb happen to sit on the same hashchain. The deadlock was introduced by commit 680c790. Before, we used share_mode_do_locked() in do_lock() which meant we acquired a chainlock on locking.tdb before getting a chainlock on brlock.tdb via brl_get_locks_for_locking(), so the TDB chainlock order invariant was always uphold. The following race between specific client requests lead to the deadlock. Client A) issues a byte-range-lock request on a file: A1) glock locking.tdb (via _share_mode_do_locked_vfs_allowed()) A2) chainlock brlock.tdb (via brl_lock()) A3) attempt to chainlock locking.tdb (via share_mode_g_lock_dump()) [1] Client B) opens a different (!) file: B1) glock and chainlock locking.tdb (via _share_mode_entry_prepare_lock()) B2) attempt to chainlock brlock.tdb (via file_has_brlocks()) [2] The glock from A1 is per record and hence doesn't synchronize with the glock from B1 as it is for a different file and hence a different record, subsequently A2 and A3 violate the lock order constraint To avoid the chainlock lock order violation in the second client we modify the br-lock code to not take the brlock.tdb chainlock from step A2 via br_get_locks() for the whole time we process the request. Instead we just fetch the br-locks via br_get_locks_readonly(), so when running into contend_level2_oplocks_begin_default() to check for leases and looking into locking.tdb we don't hold a brlock.tdb chainlock. Or im simpler terms, we only ever take at most one low-level TDB chainlock at a time: Byte-range-lock code calls share_mode_do_locked_brl(..., cb_fn, ...): 1) chainlock locking.tdb 2) glock locking.tdb (via share_mode_do_locked_vfs_allowed()) 3) chainunlock locking.tdb 4) share_mode_do_locked_brl_fn() -> brl_get_locks_readonly_parse(): a) chainlock brlock.tdb b) parse record and store in-memory copy c) chainunlock brlock.tdb 5) run cb_fn() 6) chainlock brlock.tdb: a) br_lck->record = dbwrap_fetch_locked(brlock_db, ...) b) store modifed br_lck from 5) via byte_range_lock_flush() 7) chainunlock brlock.tdb 8) chainlock locking.tdb 9) gunlock locking.tdb 10) chainunlock locking.tdb All access to brlock.tdb is synchronized correctly via glocks on the locking.tdb record of the file (step 3)), so operations still appear atomic to clients. As a result of using share_mode_do_locked_brl(), the functions do_[un]lock() -> brl_[un]lock() now loop over the same br_lck object in memory, avoiding repeatedly fetching and storing the locks per loop. [1] Full SBT: #0 0x00007fffa0cecbb0 in __pthread_mutex_lock_full () from /lib64/glibc-hwcaps/power9/libpthread-2.28.so #1 0x00007fffa0a73cf8 in chain_mutex_lock (m=<optimized out>, m@entry=0x7fff9ae071b0, waitflag=<optimized out>, waitflag@entry=true) at ../../lib/tdb/common/mutex.c:182 #2 0x00007fffa0a7432c in tdb_mutex_lock (tdb=0x1543ba120, rw=<optimized out>, off=<optimized out>, len=<optimized out>, waitflag=<optimized out>, pret=0x7fffd7df3858) at ../../lib/tdb/common/mutex.c:234 #3 0x00007fffa0a6812c in fcntl_lock (waitflag=<optimized out>, len=1, off=376608, rw=0, tdb=0x1543ba120) at ../../lib/tdb/common/lock.c:200 #4 tdb_brlock (tdb=0x1543ba120, rw_type=<optimized out>, offset=<optimized out>, len=1, flags=<optimized out>) at ../../lib/tdb/common/lock.c:200 #5 0x00007fffa0a68af8 in tdb_nest_lock (flags=<optimized out>, ltype=0, offset=<optimized out>, tdb=0x1543ba120) at ../../lib/tdb/common/lock.c:390 #6 tdb_nest_lock (tdb=0x1543ba120, offset=<optimized out>, ltype=<optimized out>, flags=<optimized out>) at ../../lib/tdb/common/lock.c:336 #7 0x00007fffa0a69088 in tdb_lock_list (tdb=0x1543ba120, list=<optimized out>, ltype=<optimized out>, waitflag=<optimized out>) at ../../lib/tdb/common/lock.c:482 #8 0x00007fffa0a69198 in tdb_lock (tdb=0x1543ba120, list=<optimized out>, ltype=<optimized out>) at ../../lib/tdb/common/lock.c:500 #9 0x00007fffa0a64b50 in tdb_find_lock_hash (tdb=<optimized out>, tdb@entry=0x1543ba120, key=..., hash=<optimized out>, locktype=<optimized out>, locktype@entry=0, rec=<optimized out>, rec@entry=0x7fffd7df3ab0) at ../../lib/tdb/common/tdb.c:165 #10 0x00007fffa0a64ed0 in tdb_parse_record (tdb=0x1543ba120, key=..., parser=0x7fffa0e74470 <db_ctdb_ltdb_parser>, private_data=0x7fffd7df3b18) at ../../lib/tdb/common/tdb.c:329 #11 0x00007fffa0e74cbc in db_ctdb_ltdb_parse (db=<optimized out>, private_data=0x7fffd7df3b70, parser=0x7fffa0e76470 <db_ctdb_parse_record_parser_nonpersistent>, key=...) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:170 #12 db_ctdb_try_parse_local_record (ctx=ctx@entry=0x1543d4580, key=..., state=state@entry=0x7fffd7df3b70) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1385 #13 0x00007fffa0e76024 in db_ctdb_parse_record (db=<optimized out>, key=..., parser=0x7fffa1313910 <dbwrap_watched_parse_record_parser>, private_data=0x7fffd7df3c08) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1425 #14 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #15 0x00007fffa1313ab4 in dbwrap_watched_parse_record (db=0x1543a7160, key=..., parser=0x7fffa13187d0 <g_lock_dump_fn>, private_data=0x7fffd7df3ce8) at ../../source3/lib/dbwrap/dbwrap_watch.c:783 #16 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #17 0x00007fffa131c004 in g_lock_dump (ctx=<error reading variable: value has been optimized out>, key=..., fn=0x7fffa14f3d70 <fsp_update_share_mode_flags_fn>, private_data=0x7fffd7df3dd8) at ../../source3/lib/g_lock.c:1653 #18 0x00007fffa14f434c in share_mode_g_lock_dump (key=..., fn=0x7fffa14f3d70 <fsp_update_share_mode_flags_fn>, private_data=0x7fffd7df3dd8) at ../../source3/locking/share_mode_lock.c:96 #19 0x00007fffa14f8d44 in fsp_update_share_mode_flags (fsp=0x15433c550) at ../../source3/locking/share_mode_lock.c:1181 #20 file_has_read_lease (fsp=0x15433c550) at ../../source3/locking/share_mode_lock.c:1207 #21 0x00007fffa15ccc98 in contend_level2_oplocks_begin_default (type=<optimized out>, fsp=0x15433c550) at ../../source3/smbd/smb2_oplock.c:1282 #22 smbd_contend_level2_oplocks_begin (fsp=0x15433c550, type=<optimized out>) at ../../source3/smbd/smb2_oplock.c:1338 #23 0x00007fffa0dd0b54 in contend_level2_oplocks_begin (fsp=<optimized out>, type=<optimized out>) at ../../source3/lib/smbd_shim.c:72 #24 0x00007fffa14ecfd0 in brl_lock_windows_default (br_lck=0x154421330, plock=0x7fffd7df4250) at ../../source3/locking/brlock.c:457 #25 0x00007fffa150b70c in vfswrap_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/modules/vfs_default.c:3424 #26 0x00007fffa1561910 in smb_vfs_call_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/smbd/vfs.c:2686 #27 0x00007fff9c0a7350 in smb_time_audit_brl_lock_windows (handle=<optimized out>, br_lck=0x154421330, plock=0x7fffd7df4250) at ../../source3/modules/vfs_time_audit.c:1740 #28 0x00007fffa1561910 in smb_vfs_call_brl_lock_windows (handle=<optimized out>, br_lck=<optimized out>, plock=<optimized out>) at ../../source3/smbd/vfs.c:2686 #29 0x00007fffa14ed410 in brl_lock (br_lck=0x154421330, smblctx=3102281601, pid=..., start=0, size=18446744073709551615, lock_type=<optimized out>, lock_flav=WINDOWS_LOCK, blocker_pid=0x7fffd7df4540, psmblctx=0x7fffd7df4558) at ../../source3/locking/brlock.c:1004 #30 0x00007fffa14e7b18 in do_lock_fn (lck=<optimized out>, private_data=0x7fffd7df4508) at ../../source3/locking/locking.c:271 #31 0x00007fffa14fcd94 in _share_mode_do_locked_vfs_allowed (id=..., fn=0x7fffa14e7a60 <do_lock_fn>, private_data=0x7fffd7df4508, location=<optimized out>) at ../../source3/locking/share_mode_lock.c:2927 #32 0x00007fffa14e918c in do_lock (fsp=0x15433c550, req_mem_ctx=<optimized out>, req_guid=<optimized out>, smblctx=<optimized out>, count=18446744073709551615, offset=0, lock_type=<optimized out>, lock_flav=<optimized out>, pblocker_pid=0x7fffd7df46f0, psmblctx=0x7fffd7df46d8) at ../../source3/locking/locking.c:335 #33 0x00007fffa155381c in smbd_do_locks_try (fsp=0x15433c550, num_locks=<optimized out>, locks=0x1543bc310, blocker_idx=0x7fffd7df46d6, blocking_pid=0x7fffd7df46f0, blocking_smblctx=0x7fffd7df46d8) at ../../source3/smbd/blocking.c:46 #34 0x00007fffa159dc90 in smbd_smb2_lock_try (req=req@entry=0x1543bc080) at ../../source3/smbd/smb2_lock.c:590 #35 0x00007fffa159ee8c in smbd_smb2_lock_send (in_locks=<optimized out>, in_lock_count=1, in_lock_sequence=<optimized out>, fsp=0x15433c550, smb2req=0x1543532e0, ev=0x154328120, mem_ctx=0x1543532e0) at ../../source3/smbd/smb2_lock.c:488 #36 smbd_smb2_request_process_lock (req=0x1543532e0) at ../../source3/smbd/smb2_lock.c:150 #37 0x00007fffa158a368 in smbd_smb2_request_dispatch (req=0x1543532e0) at ../../source3/smbd/smb2_server.c:3515 #38 0x00007fffa158c540 in smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x154313f30) at ../../source3/smbd/smb2_server.c:5112 #39 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:5150 #40 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543670f0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #41 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4b28, epoll_ev=0x1543b4e80) at ../../lib/tevent/tevent_epoll.c:730 #42 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #43 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:110 #44 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent.c:823 #45 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #46 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:141 #47 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #48 0x00007fffa15737fc in smbd_process (ev_ctx=0x154328120, msg_ctx=<optimized out>, sock_fd=<optimized out>, interactive=<optimized out>) at ../../source3/smbd/smb2_process.c:2158 #49 0x000000011db5c554 in smbd_accept_connection (ev=0x154328120, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1150 #50 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543ac2d0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #51 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4f98, epoll_ev=0x154328350) at ../../lib/tevent/tevent_epoll.c:730 #52 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #53 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:110 #54 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent.c:823 #55 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #56 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:141 #57 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #58 0x000000011db58c54 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x154328120) at ../../source3/smbd/server.c:1499 #59 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2258 [2] Full SBT: #0 0x00007fffa0cecbb0 in __pthread_mutex_lock_full () from /lib64/glibc-hwcaps/power9/libpthread-2.28.so #1 0x00007fffa0a73cf8 in chain_mutex_lock (m=<optimized out>, m@entry=0x7fff9b3a71b0, waitflag=<optimized out>, waitflag@entry=true) at ../../lib/tdb/common/mutex.c:182 #2 0x00007fffa0a7432c in tdb_mutex_lock (tdb=0x1543c6900, rw=<optimized out>, off=<optimized out>, len=<optimized out>, waitflag=<optimized out>, pret=0x7fffd7df2e28) at ../../lib/tdb/common/mutex.c:234 #3 0x00007fffa0a6812c in fcntl_lock (waitflag=<optimized out>, len=1, off=376608, rw=0, tdb=0x1543c6900) at ../../lib/tdb/common/lock.c:200 #4 tdb_brlock (tdb=0x1543c6900, rw_type=<optimized out>, offset=<optimized out>, len=1, flags=<optimized out>) at ../../lib/tdb/common/lock.c:200 #5 0x00007fffa0a68af8 in tdb_nest_lock (flags=<optimized out>, ltype=0, offset=<optimized out>, tdb=0x1543c6900) at ../../lib/tdb/common/lock.c:390 #6 tdb_nest_lock (tdb=0x1543c6900, offset=<optimized out>, ltype=<optimized out>, flags=<optimized out>) at ../../lib/tdb/common/lock.c:336 #7 0x00007fffa0a69088 in tdb_lock_list (tdb=0x1543c6900, list=<optimized out>, ltype=<optimized out>, waitflag=<optimized out>) at ../../lib/tdb/common/lock.c:482 #8 0x00007fffa0a69198 in tdb_lock (tdb=0x1543c6900, list=<optimized out>, ltype=<optimized out>) at ../../lib/tdb/common/lock.c:500 #9 0x00007fffa0a64b50 in tdb_find_lock_hash (tdb=<optimized out>, tdb@entry=0x1543c6900, key=..., hash=<optimized out>, locktype=<optimized out>, locktype@entry=0, rec=<optimized out>, rec@entry=0x7fffd7df3080) at ../../lib/tdb/common/tdb.c:165 #10 0x00007fffa0a64ed0 in tdb_parse_record (tdb=0x1543c6900, key=..., parser=0x7fffa0e74470 <db_ctdb_ltdb_parser>, private_data=0x7fffd7df30e8) at ../../lib/tdb/common/tdb.c:329 #11 0x00007fffa0e74cbc in db_ctdb_ltdb_parse (db=<optimized out>, private_data=0x7fffd7df3140, parser=0x7fffa0e76470 <db_ctdb_parse_record_parser_nonpersistent>, key=...) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:170 #12 db_ctdb_try_parse_local_record (ctx=ctx@entry=0x154328fc0, key=..., state=state@entry=0x7fffd7df3140) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1385 #13 0x00007fffa0e76024 in db_ctdb_parse_record (db=<optimized out>, key=..., parser=0x7fffa14ec820 <brl_get_locks_readonly_parser>, private_data=0x7fffd7df3218) at ../../source3/lib/dbwrap/dbwrap_ctdb.c:1425 #14 0x00007fffa0884760 in dbwrap_parse_record (db=<optimized out>, key=..., parser=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:454 #15 0x00007fffa14ef5bc in brl_get_locks_readonly (fsp=0x1543d01e0) at ../../source3/locking/brlock.c:1884 #16 0x00007fffa1546968 in file_has_brlocks (fsp=0x1543d01e0) at ../../source3/smbd/open.c:2232 #17 delay_for_oplock (pgranted=<synthetic pointer>, poplock_type=<synthetic pointer>, first_open_attempt=<optimized out>, create_disposition=1, have_sharing_violation=false, lck=0x7fffd7df3ce8, lease=0x0, oplock_request=0, fsp=0x1543d01e0) at ../../source3/smbd/open.c:2749 #18 handle_share_mode_lease (pgranted=<synthetic pointer>, poplock_type=<synthetic pointer>, first_open_attempt=<optimized out>, lease=0x0, oplock_request=0, share_access=7, access_mask=131201, create_disposition=1, lck=0x7fffd7df3ce8, fsp=0x1543d01e0) at ../../source3/smbd/open.c:2865 #19 check_and_store_share_mode (first_open_attempt=<optimized out>, lease=0x0, oplock_request=0, share_access=7, access_mask=131201, create_disposition=1, lck=0x7fffd7df3ce8, req=0x154414800, fsp=0x1543d01e0) at ../../source3/smbd/open.c:3333 #20 open_ntcreate_lock_add_entry (lck=0x7fffd7df3ce8, keep_locked=0x7fffd7df3ad0, private_data=0x7fffd7df3cc8) at ../../source3/smbd/open.c:3688 #21 0x00007fffa14f6248 in share_mode_entry_prepare_lock_fn (glck=0x7fffd7df35b8, cb_private=0x7fffd7df3a88) at ../../source3/locking/share_mode_lock.c:2978 #22 0x00007fffa1317680 in g_lock_lock_cb_run_and_store (cb_state=cb_state@entry=0x7fffd7df35b8) at ../../source3/lib/g_lock.c:597 #23 0x00007fffa1319df8 in g_lock_lock_simple_fn (rec=0x7fffd7df3798, value=..., private_data=0x7fffd7df39a0) at ../../source3/lib/g_lock.c:1212 #24 0x00007fffa13160e0 in dbwrap_watched_do_locked_fn (backend_rec=<optimized out>, backend_value=..., private_data=0x7fffd7df3768) at ../../source3/lib/dbwrap/dbwrap_watch.c:458 #25 0x00007fffa0884e48 in dbwrap_do_locked (db=<optimized out>, key=..., fn=0x7fffa1316080 <dbwrap_watched_do_locked_fn>, private_data=0x7fffd7df3768) at ../../lib/dbwrap/dbwrap.c:602 #26 0x00007fffa1315274 in dbwrap_watched_do_locked (db=0x1543a7160, key=..., fn=0x7fffa1319ca0 <g_lock_lock_simple_fn>, private_data=0x7fffd7df39a0) at ../../source3/lib/dbwrap/dbwrap_watch.c:480 #27 0x00007fffa0884d60 in dbwrap_do_locked (db=<optimized out>, key=..., fn=<optimized out>, private_data=<optimized out>) at ../../lib/dbwrap/dbwrap.c:582 #28 0x00007fffa131b458 in g_lock_lock (ctx=0x1543cc630, key=..., type=<optimized out>, timeout=..., cb_fn=0x7fffa14f6190 <share_mode_entry_prepare_lock_fn>, cb_private=0x7fffd7df3a88) at ../../source3/lib/g_lock.c:1267 #29 0x00007fffa14fd060 in _share_mode_entry_prepare_lock (prepare_state=0x7fffd7df3cc8, id=..., servicepath=<optimized out>, smb_fname=<optimized out>, old_write_time=<optimized out>, fn=<optimized out>, private_data=0x7fffd7df3cc8, location=0x7fffa165b880 "../../source3/smbd/open.c:4292") at ../../source3/locking/share_mode_lock.c:3033 #30 0x00007fffa15491e0 in open_file_ntcreate (conn=conn@entry=0x154382050, req=req@entry=0x154414800, access_mask=<optimized out>, access_mask@entry=131201, share_access=share_access@entry=7, create_disposition=create_disposition@entry=1, create_options=create_options@entry=0, new_dos_attributes=<optimized out>, new_dos_attributes@entry=128, oplock_request=oplock_request@entry=0, lease=<optimized out>, lease@entry=0x0, private_flags=<optimized out>, private_flags@entry=0, parent_dir_fname=<optimized out>, smb_fname_atname=<optimized out>, pinfo=<optimized out>, pinfo@entry=0x7fffd7df3f1c, fsp=<optimized out>, fsp@entry=0x1543d01e0) at ../../source3/smbd/open.c:4286 #31 0x00007fffa154b94c in create_file_unixpath (conn=conn@entry=0x154382050, req=req@entry=0x154414800, dirfsp=dirfsp@entry=0x15439a7f0, smb_fname=smb_fname@entry=0x154416300, access_mask=access_mask@entry=131201, share_access=share_access@entry=7, create_disposition=create_disposition@entry=1, create_options=create_options@entry=0, file_attributes=file_attributes@entry=128, oplock_request=<optimized out>, oplock_request@entry=0, lease=<optimized out>, lease@entry=0x0, allocation_size=allocation_size@entry=0, private_flags=private_flags@entry=0, sd=sd@entry=0x0, ea_list=ea_list@entry=0x0, result=result@entry=0x7fffd7df4168, pinfo=pinfo@entry=0x7fffd7df4160) at ../../source3/smbd/open.c:6290 #32 0x00007fffa154dfac in create_file_default (conn=0x154382050, req=0x154414800, dirfsp=0x15439a7f0, smb_fname=0x154416300, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/open.c:6609 #33 0x00007fffa150972c in vfswrap_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/modules/vfs_default.c:776 #34 0x00007fffa1559cbc in smb_vfs_call_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/vfs.c:1560 #35 0x00007fff9c0a9ec4 in smb_time_audit_create_file (handle=0x154426820, req=0x154414800, dirfsp=0x15439a7f0, fname=0x154416300, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result_fsp=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/modules/vfs_time_audit.c:634 #36 0x00007fffa1559cbc in smb_vfs_call_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=128, oplock_request=0, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x1544144e8, pinfo=0x1544144fc, in_context_blobs=0x7fffd7df4798, out_context_blobs=0x154414710) at ../../source3/smbd/vfs.c:1560 #37 0x00007fffa1597aa8 in smbd_smb2_create_send (in_context_blobs=..., in_name=0x154413ca0, in_create_options=<optimized out>, in_create_disposition=<optimized out>, in_share_access=<optimized out>, in_file_attributes=<optimized out>, in_desired_access=<optimized out>, in_impersonation_level=<optimized out>, in_oplock_level=<optimized out>, smb2req=0x154413770, ev=0x154328120, mem_ctx=0x154413770) at ../../source3/smbd/smb2_create.c:1115 #38 smbd_smb2_request_process_create (smb2req=0x154413770) at ../../source3/smbd/smb2_create.c:291 #39 0x00007fffa158a628 in smbd_smb2_request_dispatch (req=0x154413770) at ../../source3/smbd/smb2_server.c:3485 #40 0x00007fffa158c540 in smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x154313f30) at ../../source3/smbd/smb2_server.c:5112 #41 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:5150 #42 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x15435add0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #43 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4b28, epoll_ev=0x1543b4e80) at ../../lib/tevent/tevent_epoll.c:730 #44 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #45 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:110 #46 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent.c:823 #47 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #48 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x7fffa1668db8 "../../source3/smbd/smb2_process.c:2158") at ../../lib/tevent/tevent_standard.c:141 #49 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #50 0x00007fffa15737fc in smbd_process (ev_ctx=0x154328120, msg_ctx=<optimized out>, sock_fd=<optimized out>, interactive=<optimized out>) at ../../source3/smbd/smb2_process.c:2158 #51 0x000000011db5c554 in smbd_accept_connection (ev=0x154328120, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1150 #52 0x00007fffa1198b2c in tevent_common_invoke_fd_handler (fde=0x1543ac2d0, flags=<optimized out>, removed=0x0) at ../../lib/tevent/tevent_fd.c:158 #53 0x00007fffa11a2b9c in epoll_event_loop (tvalp=0x7fffd7df4f98, epoll_ev=0x154328350) at ../../lib/tevent/tevent_epoll.c:730 #54 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:946 #55 0x00007fffa11a0090 in std_event_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:110 #56 0x00007fffa119744c in _tevent_loop_once (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent.c:823 #57 0x00007fffa1197884 in tevent_common_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:950 #58 0x00007fffa119ffc0 in std_event_loop_wait (ev=0x154328120, location=0x11db60b50 "../../source3/smbd/server.c:1499") at ../../lib/tevent/tevent_standard.c:141 #59 0x00007fffa1197978 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:971 #60 0x000000011db58c54 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x154328120) at ../../source3/smbd/server.c:1499 #61 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2258 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15767 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> (backported from commit 2eef298) [slow@samba.org: changed argument of share_mode_watch_send()] [slow@samba.org: small context change in vfs_fruit]

==556308==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d2f14452360 at pc 0x7baf0a5c3a8b bp 0x7ffe6e1eb2e0 sp 0x7ffe6e1eb2d8 11:26:39 [1226/65848] READ of size 4 at 0x7d2f14452360 thread T0 #0 0x7baf0a5c3a8a in py_cli_notify_get_changes ../../source3/libsmb/pylibsmb.c:2291 #1 0x7faf165ba239 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1ba239) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #2 0x7faf1658c798 in PyObject_Vectorcall (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18c798) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #3 0x7faf165a366e in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1a366e) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #4 0x7faf165db031 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1db031) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #5 0x7faf1659fa1d in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19fa1d) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #6 0x7faf1658ce9b (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18ce9b) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #7 0x7faf1667a637 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x27a637) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #8 0x7faf1658a726 in _PyObject_MakeTpCall (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18a726) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #9 0x7faf1659ae9b in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19ae9b) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #10 0x7faf165db031 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1db031) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #11 0x7faf1659fa1d in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19fa1d) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #12 0x7faf1658ce9b (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18ce9b) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #13 0x7faf1667a637 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x27a637) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #14 0x7faf1658a726 in _PyObject_MakeTpCall (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18a726) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #15 0x7faf1659ae9b in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19ae9b) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #16 0x7faf165db031 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1db031) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #17 0x7faf1659fa1d in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19fa1d) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #18 0x7faf1658ce9b (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18ce9b) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #19 0x7faf1667a637 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x27a637) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #20 0x7faf1658a726 in _PyObject_MakeTpCall (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18a726) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #21 0x7faf1659e0ae in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19e0ae) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #22 0x7faf165db031 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1db031) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #23 0x7faf1659fa1d in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19fa1d) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #24 0x7faf1658ce9b (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18ce9b) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #25 0x7faf1667a637 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x27a637) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #26 0x7faf1658a726 in _PyObject_MakeTpCall (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18a726) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #27 0x7faf1659e0ae in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19e0ae) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #28 0x7faf1658cf1b (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18cf1b) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #29 0x7faf165c3c5a (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1c3c5a) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #30 0x7faf1658a9b5 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18a9b5) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #31 0x7faf1658a726 in _PyObject_MakeTpCall (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18a726) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #32 0x7faf165a366e in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1a366e) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #33 0x7faf1662f875 in PyEval_EvalCode (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x22f875) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #34 0x7faf166498fc (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x2498fc) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #35 0x7faf165b17fe (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1b17fe) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #36 0x7faf1658c798 in PyObject_Vectorcall (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x18c798) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #37 0x7faf1659e0ae in _PyEval_EvalFrameDefault (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x19e0ae) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #38 0x7faf16664a89 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x264a89) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #39 0x7faf16663a38 in Py_RunMain (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x263a38) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #40 0x7faf1661e3b5 in Py_BytesMain (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x21e3b5) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) #41 0x7faf1602b2fa in __libc_start_call_main (/lib64/libc.so.6+0x2b2fa) (BuildId: 8523b213e7586a93ab00f6dd476418b1e521e62c) #42 0x7faf1602b3ca in __libc_start_main_impl (/lib64/libc.so.6+0x2b3ca) (BuildId: 8523b213e7586a93ab00f6dd476418b1e521e62c) #43 0x564f2695f074 in _start (/usr/bin/python3.13+0x1074) (BuildId: 381e7a168bb2c479b5b88bcfd875777e342d6b45) 0x7d2f14452360 is located 736 bytes inside of 861-byte region [0x7d2f14452080,0x7d2f144523dd) freed by thread T0 here: #0 0x7faf16d208eb (/lib64/libasan.so.8+0x1208eb) (BuildId: 61b31c4760766f5f2552c32e175755894d8f6565) #1 0x7faf14560a72 in _tc_free_poolmem ../../lib/talloc/talloc.c:1080 #2 0x7faf1455f71b in _tc_free_internal ../../lib/talloc/talloc.c:1215 #3 0x7faf1455ee1b in _tc_free_children_internal ../../lib/talloc/talloc.c:1669 #4 0x7faf1455ee1b in _tc_free_internal ../../lib/talloc/talloc.c:1184 #5 0x7faf14560315 in _talloc_free_internal ../../lib/talloc/talloc.c:1248 #6 0x7faf14560315 in _talloc_free ../../lib/talloc/talloc.c:1792 #7 0x7baf0a5c3883 in py_cli_notify_get_changes ../../source3/libsmb/pylibsmb.c:2274 #8 0x7faf165ba239 (/lib64/glibc-hwcaps/x86-64-v3/libpython3.13.so.1.0+0x1ba239) (BuildId: 3925b60e845f4803e4de04e1fdf7845f2e54ecb0) Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Oct 14 12:35:37 UTC 2025 on atb-devel-224

With the patches coming before this patch, we can use main talloc context to allocate the connections on and make sure we only free them after we don't need them anymore. This fixes a lot of memory leaks found by LeakSanitizer. One example is: ==838668==ERROR: LeakSanitizer: detected memory leaks Indirect leak of 4784 byte(s) in 13 object(s) allocated from: #0 0x7fdb1ef21c2b in malloc (/lib64/libasan.so.8+0x121c2b) (BuildId: cbfe49f3b7600c4f194d4c54774c977296e9d98a) #1 0x7fdb1ebbb6a0 in __talloc_with_prefix ../../lib/talloc/talloc.c:783 #2 0x7fdb1ebbcf75 in __talloc ../../lib/talloc/talloc.c:825 #3 0x7fdb1ebbcf75 in _talloc_named_const ../../lib/talloc/talloc.c:982 #4 0x7fdb1ebbcf75 in _talloc_zero ../../lib/talloc/talloc.c:2421 #5 0x7fdb1cfd1b25 in idr_pre_get ../../lib/util/idtree.c:98 #6 0x7fdb1cfd1b25 in idr_get_new_above_int ../../lib/util/idtree.c:202 #7 0x7fdb1cfd2c30 in idr_get_new_above ../../lib/util/idtree.c:368 #8 0x7fdb1de3246f in map_smb2_handle_to_fnum ../../source3/libsmb/cli_smb2_fnum.c:95 #9 0x7fdb1de3246f in cli_smb2_create_fnum_done ../../source3/libsmb/cli_smb2_fnum.c:438 #10 0x7fdb1dbaca05 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #11 0x7fdb1dbacc3c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #12 0x7fdb1dbacca4 in _tevent_req_done ../../lib/tevent/tevent_req.c:240 #13 0x7fdb1ed0eb35 in smb2cli_create_done ../../libcli/smb/smb2cli_create.c:483 #14 0x7fdb1dbaca05 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177 #15 0x7fdb1dbacc3c in tevent_req_finish ../../lib/tevent/tevent_req.c:234 #16 0x7fdb1dbacd74 in tevent_req_trigger ../../lib/tevent/tevent_req.c:291 #17 0x7fdb1dbaad1e in tevent_common_invoke_immediate_handler ../../lib/tevent/tevent_immediate.c:190 #18 0x7fdb1dbaad5b in tevent_common_loop_immediate ../../lib/tevent/tevent_immediate.c:236 #19 0x7fdb1dbbe42f in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:908 #20 0x7fdb1dbb7787 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110 #21 0x7fdb1dba7466 in _tevent_loop_once ../../lib/tevent/tevent.c:860 #22 0x7fdb1dbad082 in tevent_req_poll ../../lib/tevent/tevent_req.c:342 #23 0x7fdb1eaa93d4 in tevent_req_poll_ntstatus ../../lib/util/tevent_ntstatus.c:109 #24 0x7fdb1de138bb in cli_list ../../source3/libsmb/clilist.c:1188 #25 0x000000239f0f in do_list ../../source3/client/client.c:853 #26 0x00000023a93a in cmd_dir ../../source3/client/client.c:936 #27 0x00000023f090 in process_stdin ../../source3/client/client.c:6215 #28 0x00000023f090 in process ../../source3/client/client.c:6269 #29 0x00000023f090 in main ../../source3/client/client.c:6811 #30 0x7fdb1ac2b2fa in __libc_start_call_main (/lib64/libc.so.6+0x2b2fa) (BuildId: 8523b213e7586a93ab00f6dd476418b1e521e62c) #31 0x7ffd7d5613af ([stack]+0x3a3af) Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Thu Nov 6 09:58:52 UTC 2025 on atb-devel-224

build:wafsamba: removed most import * statements

9cc476e

The 'import *' statements make it more difficult to reason about the modules and tends to conceal bugs. These changes enable running pyflakes against most of the build scripts. Signed-off-by: Thomas Nagy <tnagy@waf.io>

obnoxxx closed this Oct 28, 2015

ita1024 deleted the import_simplification branch November 18, 2015 23:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build:wafsamba: removed most import * statements#29

build:wafsamba: removed most import * statements#29
ita1024 wants to merge 1 commit intosamba-team:masterfrom
ita1024:import_simplification

ita1024 commented Oct 27, 2015

Uh oh!

abartlet commented Oct 27, 2015

Uh oh!

obnoxxx commented Oct 28, 2015

Uh oh!

abartlet commented Oct 28, 2015

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

ita1024 commented Oct 27, 2015

Uh oh!

abartlet commented Oct 27, 2015

Uh oh!

obnoxxx commented Oct 28, 2015

Uh oh!

abartlet commented Oct 28, 2015

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants