Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1512414 - tevent can cause a Samba file corruption bug under heavy threaded load
Summary: tevent can cause a Samba file corruption bug under heavy threaded load
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libtevent
Version: 7.4
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Jakub Hrozek
QA Contact: shridhar
Depends On:
Blocks: 1513984
TreeView+ depends on / blocked
Reported: 2017-11-13 07:30 UTC by Andreas Schneider
Modified: 2018-04-23 07:58 UTC (History)
5 users (show)

Fixed In Version: libtevent-0.9.33-2.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1513984 (view as bug list)
Last Closed: 2018-04-10 16:14:52 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0887 None None None 2018-04-10 16:15:05 UTC
Samba Project 13130 None None None 2017-11-13 07:30:13 UTC

Description Andreas Schneider 2017-11-13 07:30:14 UTC
Description of problem:
A race condition in the tevent threaded code can cause tevent_common_wakeup_fd(tctx->wakeup_fd) to be called where wakeup_fd is being read out of reused memory unprotected by mutex lock (tctx may no longer exist).

If the reused memory happens to point to a wakeup_fd value that matches a file descriptor in use by smbd to write to a on-disk file, file corruption will result.

Comment 1 Andreas Schneider 2017-11-13 07:32:52 UTC
This bug is for Samba more important than a security release because it can corrupt on disk data we try to avoid in any circumstance!

Comment 5 Andreas Schneider 2017-11-14 11:36:01 UTC
I don't think so or there would be one in the upstream testsuite.

Comment 8 shridhar 2017-12-01 07:52:08 UTC
How to verify this bug?

Comment 9 Jakub Hrozek 2017-12-03 20:22:41 UTC
(In reply to shridhar from comment #8)
> How to verify this bug?

Just with regression testing.

Comment 10 shridhar 2017-12-21 11:50:44 UTC
verified with  sssd-1.16.0-9.el7.x86_64 
No error/failures found from regression runs

Comment 11 Andreas Schneider 2018-01-02 13:53:37 UTC
Run the tevent test suite. I think it is part of the RPM build ...

Comment 14 errata-xmlrpc 2018-04-10 16:14:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.