[Pkg-samba-maint] Bug#509101: Process crush when using gethostbyname_r in several threads

[Oleg Malashenko]

Package: winbind
Version: 2:3.2.5-1
Severity: normal

When using libnss_wins.so backend for name resolving, process crushes 
when gethostbyname_r is called simultaneously in several threads. Simple 
test is attached.

Sometimes it crush with 'glibc double free detected', sometimes with SIGSEGV
Stack trace follows

(gdb) r
Starting program: /home/xen/work/ngp/test/ghbn_r/gethostbyname_r
[Thread debugging using libthread_db enabled]
[New Thread 0xb7d506b0 (LWP 2475)]
[New Thread 0xb7d4fb90 (LWP 2478)]
0.[New Thread 0xb7532b90 (LWP 2480)]
0.1.1.
Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb7532b90 (LWP 2480)]
0xb7ee4424 in __kernel_vsyscall ()
(gdb) bt
#0  0xb7ee4424 in __kernel_vsyscall ()
#1  0xb7d7d640 in raise () from /lib/i686/cmov/libc.so.6
#2  0xb7d7f018 in abort () from /lib/i686/cmov/libc.so.6
#3  0xb69e1505 in talloc_strdup () from /usr/lib/libtalloc.so.1
#4  0xb6c665d8 in talloc_sub_basic () from /lib/libnss_wins.so.2
#5  0xb6ba9051 in ?? () from /lib/libnss_wins.so.2
#6  0x0874f368 in ?? ()
#7  0xb6cf1146 in ?? () from /lib/libnss_wins.so.2
#8  0xb6d311c0 in current_user_info () from /lib/libnss_wins.so.2
#9  0x086fb7c0 in ?? ()
#10 0x00000000 in ?? ()
(gdb) info threads
* 3 Thread 0xb7532b90 (LWP 2480)  0xb7ee4424 in __kernel_vsyscall ()
   2 Thread 0xb7d4fb90 (LWP 2478)  0xb7ee4424 in __kernel_vsyscall ()
   1 Thread 0xb7d506b0 (LWP 2475)  0xb7ee4424 in __kernel_vsyscall ()
(gdb) t 2
[Switching to thread 2 (Thread 0xb7d4fb90 (LWP 2478))]#0  0xb7ee4424 in
__kernel_vsyscall ()
(gdb) bt
#0  0xb7ee4424 in __kernel_vsyscall ()
#1  0xb7e2a9f1 in select () from /lib/i686/cmov/libc.so.6
#2  0xb6c683b9 in sys_select_intr () from /lib/libnss_wins.so.2
#3  0xb6c02d8a in receive_packet () from /lib/libnss_wins.so.2
#4  0xb6c02eeb in receive_nmb_packet () from /lib/libnss_wins.so.2
#5  0xb6c04767 in name_query () from /lib/libnss_wins.so.2
#6  0xb6ba537c in _nss_wins_gethostbyname_r () from /lib/libnss_wins.so.2
#7  0xb7e4c08b in gethostbyname_r@@GLIBC_2.1.2 () from
/lib/i686/cmov/libc.so.6
#8  0x08048662 in thread_proc (arg=0x0) at
/home/xen/work/ngp/test/ghbn_r/main.c:21
#9  0xb7eb34c0 in start_thread () from /lib/i686/cmov/libpthread.so.0
#10 0xb7e3261e in clone () from /lib/i686/cmov/libc.so.6
(gdb) t 1
[Switching to thread 1 (Thread 0xb7d506b0 (LWP 2475))]#0  0xb7ee4424 in
__kernel_vsyscall ()
(gdb) bt
#0  0xb7ee4424 in __kernel_vsyscall ()
#1  0xb7eb3ba7 in pthread_join () from /lib/i686/cmov/libpthread.so.0
#2  0x080487a8 in main () at /home/xen/work/ngp/test/ghbn_r/main.c:36

-- System Information:
Debian Release: lenny/sid
   APT prefers testing
   APT policy: (500, 'testing')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/2 CPU cores)
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages winbind depends on:
ii  adduser              3.110               add and remove users and groups
ii  libc6                2.7-16              GNU C Library: Shared libraries
ii  libcomerr2           1.41.3-1            common error description
library
ii  libkrb53             1.6.dfsg.4~beta1-4  MIT Kerberos runtime libraries
ii  libldap-2.4-2        2.4.11-1            OpenLDAP libraries
ii  libpam0g             1.0.1-4             Pluggable Authentication
Modules l
ii  libpopt0             1.14-4              lib for parsing cmdline
parameters
ii  libtalloc1           1.2.0~git20080616-1 hierarchical pool based
memory all
ii  libwbclient0         2:3.2.4-1           client library for
interfacing wit
ii  lsb-base             3.2-20              Linux Standard Base 3.2
init scrip
ii  samba-common         2:3.2.5-1           Samba common files used by
both th

winbind recommends no packages.

winbind suggests no packages.

-- no debconf information


-------------- next part --------------
A non-text attachment was scrubbed...
Name: wins_test.tar.gz
Type: application/x-gzip
Size: 1205 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/pkg-samba-maint/attachments/20081218/e67150d9/attachment.bin