From bb3365aee62f616c9d0c8cc8d737ef69d46544d3 Mon Sep 17 00:00:00 2001

From: Lukas Slebodnik <lslebodn@redhat.com>

Date: Thu, 22 Oct 2015 10:30:12 +0200

Subject: [PATCH 117/117] LDAP: Fix leak of file descriptors

The state "struct sss_ldap_init_state" contains socket

created in function sss_ldap_init_send. We register callback

sdap_async_sys_connect_timeout for handling issue with connection

The tevent request "sss_ldap_init_send" is usually (nested) subrequest

of "struct resolve_service_state" related request created in fucntion

fo_resolve_service_send. Function fo_resolve_service_send also register

timeout callback fo_resolve_service_timeout to state "struct

resolve_service_state".

It might happen that fo_resolve_service_timeout will be called before

sss_ldap_init_send timeout and we could not handle tiemout error

for state "struct sss_ldap_init_state" and therefore created socket

was not closed.

We tried to release resources in function sdap_handle_release.

But the structure "struct sdap_handle" had not been initialized yet

with LDAP handle and therefore associated file descriptor could not be closed.

[fo_resolve_service_timeout] (0x0080): Service resolving timeout reached

[fo_resolve_service_recv] (0x0020): TEVENT_REQ_RETURN_ON_ERROR ret[110]

[sdap_handle_release] (0x2000): Trace: sh[0x7f6713410270], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory

[be_resolve_server_done] (0x1000): Server resolution failed: 14

[be_resolve_server_recv] (0x0020): TEVENT_REQ_RETURN_ON_ERROR ret[14]

[check_online_callback] (0x0100): Backend returned: (1, 0, <NULL>) [Provider is Offline (Success)]

Resolves:

https://fedorahosted.org/sssd/ticket/2792

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

(cherry picked from commit a10f67d4c64f3b1243de5d86a996475361adf0ac)

(cherry picked from commit db2fdba6f3cecd0612439988e61be60d5d8576bf)

(cherry picked from commit 2136f71c94660bcdde83f80feb83734389d57674)

---

 src/util/sss_ldap.c | 29 +++++++++++++++++++++--------

 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c

index dd63b4b4f22f0aa1b540bc04ede211ac9cb88ebe..f42f9404bb9b79cdeb6a01c0a6e5025bb0370a6c 100644

--- a/src/util/sss_ldap.c

+++ b/src/util/sss_ldap.c

@@ -304,6 +304,22 @@ struct sss_ldap_init_state {

 #endif

 };

+static int sss_ldap_init_state_destructor(void *data)

+{

+    struct sss_ldap_init_state *state = (struct sss_ldap_init_state *)data;

+

+    if (state->ldap) {

+        DEBUG(SSSDBG_TRACE_FUNC,

+              "calling ldap_unbind_ext for ldap:[%p] sd:[%d]\n",

+              state->ldap, state->sd);

+        ldap_unbind_ext(state->ldap, NULL, NULL);

+    } else if (state->sd != -1) {

+        DEBUG(SSSDBG_TRACE_FUNC, "closing socket [%d]\n", state->sd);

+        close(state->sd);

+    }

+

+    return 0;

+}

 struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,

                                       struct tevent_context *ev,

@@ -321,6 +337,8 @@ struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,

         return NULL;

     }

+    talloc_set_destructor((TALLOC_CTX *)state, sss_ldap_init_state_destructor);

+

     state->ldap = NULL;

     state->uri = uri;

@@ -370,9 +388,6 @@ struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,

     return req;

 fail:

-    if(state->sd >= 0) {

-        close(state->sd);

-    }

     tevent_req_error(req, ret);

 #else

     DEBUG(SSSDBG_MINOR_FAILURE, "ldap_init_fd not available, "

@@ -455,11 +470,6 @@ static void sss_ldap_init_sys_connect_done(struct tevent_req *subreq)

     return;

 fail:

-    if (state->ldap) {

-        ldap_unbind_ext(state->ldap, NULL, NULL);

-    } else {

-        close(state->sd);

-    }

     tevent_req_error(req, ret);

 }

 #endif

@@ -470,6 +480,9 @@ int sss_ldap_init_recv(struct tevent_req *req, LDAP **ldap, int *sd)

                                                     struct sss_ldap_init_state);

     TEVENT_REQ_RETURN_ON_ERROR(req);

+    /* Everything went well therefore we do not want to release resources */

+    talloc_set_destructor(state, NULL);

+

     *ldap = state->ldap;

     *sd = state->sd;

-- 

2.4.11