[Bug 2085389] Re: File descriptor leak on /var/lib/sss/pipes/nss socket

[Matthew Ruffell]

** Description changed:

  [Impact]
  
  When running in a multithreaded environment each pthread that opens the
  /var/lib/sss/pipes/nss socket retains the file descriptor in a thread
  specific structure. This file descriptor should be closed when the
  thread is destroyed but due to a bug it is left open thus generating the
  leak.
  
  [Test Plan]
  
  This code generates many threads that open the mentioned socket.
  
+ Install the needed packages:
+ 
+ $ sudo apt install sssd build-essential
+ $ cat > test_code.c < EOF
  #include <pwd.h>
  #include <unistd.h>
  #include <pthread.h>
  
  static void *client(void *arg)
  {
      int i = *((int *)arg);
      struct passwd pwd;
      char buf[10000];
      struct passwd *r;
  
      getpwuid_r(i, &pwd, buf, 10000, &r);
  
      return NULL;
  }
  
  int main(void)
  {
      pthread_t thread;
      int arg;
      void *t_ret;
  
      for (int i = 0; i < 1000; ++i) {
          arg = 100000+i;
          pthread_create(&thread, NULL, client, &arg);
          pthread_join(thread, &t_ret);
      }
  
      while (1) {
          sleep(1);
      }
  
      return 0;
  }
+ EOF
+ $ gcc -o test_code test_code.c -lpthread
+ $ ./test_code
  
  The file descriptor leak problem can be tested by compiling this code as
  a test_code binary for example and running
  
  lsof -p `pidof test_code` | wc -l
  
  The count can reach more than a thousand when should not be bigger than
  around 20 normally.
  
  [Where problems could occur]
  
  The patched code correctly accesses the thread specific structure to get
  the file descriptor and close the socket. Previously it just considered
  the structure was null and did nothing. The only new problems that could
  occur are related to the closing of the socket but that would be not
  worse than the previous situation.
  
  [Other Info]
  
  This bug only affects Noble. This is the original github issue that was patched:
  https://github.com/SSSD/sssd/issues/7189

** Description changed:

  [Impact]
  
  When running in a multithreaded environment each pthread that opens the
  /var/lib/sss/pipes/nss socket retains the file descriptor in a thread
  specific structure. This file descriptor should be closed when the
  thread is destroyed but due to a bug it is left open thus generating the
  leak.
  
  [Test Plan]
  
  This code generates many threads that open the mentioned socket.
- 
- Install the needed packages:
  
  $ sudo apt install sssd build-essential
  $ cat > test_code.c < EOF
  #include <pwd.h>
  #include <unistd.h>
  #include <pthread.h>
  
  static void *client(void *arg)
  {
      int i = *((int *)arg);
      struct passwd pwd;
      char buf[10000];
      struct passwd *r;
  
      getpwuid_r(i, &pwd, buf, 10000, &r);
  
      return NULL;
  }
  
  int main(void)
  {
      pthread_t thread;
      int arg;
      void *t_ret;
  
      for (int i = 0; i < 1000; ++i) {
          arg = 100000+i;
          pthread_create(&thread, NULL, client, &arg);
          pthread_join(thread, &t_ret);
      }
  
      while (1) {
          sleep(1);
      }
  
      return 0;
  }
  EOF
  $ gcc -o test_code test_code.c -lpthread
  $ ./test_code
  
  The file descriptor leak problem can be tested by compiling this code as
  a test_code binary for example and running
  
- lsof -p `pidof test_code` | wc -l
+ $ lsof -p `pidof test_code` | wc -l
  
  The count can reach more than a thousand when should not be bigger than
  around 20 normally.
  
  [Where problems could occur]
  
  The patched code correctly accesses the thread specific structure to get
  the file descriptor and close the socket. Previously it just considered
  the structure was null and did nothing. The only new problems that could
  occur are related to the closing of the socket but that would be not
  worse than the previous situation.
  
  [Other Info]
  
  This bug only affects Noble. This is the original github issue that was patched:
  https://github.com/SSSD/sssd/issues/7189
+ 
+ Fixed in commit:
+ commit b439847bc88ad7b89f0596af822c0ffbf2a579df
+ From: Sumit Bose <sbose at redhat.com>
+ Date: Tue, 23 Jan 2024 09:28:26 +0100
+ Subject: sss-client: handle key value in destructor
+ Link: https://github.com/SSSD/sssd/commit/b439847

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2085389

Title:
  File descriptor leak on /var/lib/sss/pipes/nss socket

Status in sssd package in Ubuntu:
  Fix Released
Status in sssd source package in Noble:
  In Progress
Status in sssd source package in Oracular:
  Fix Released
Status in sssd source package in Plucky:
  Fix Released

Bug description:
  [Impact]

  When running in a multithreaded environment each pthread that opens
  the /var/lib/sss/pipes/nss socket retains the file descriptor in a
  thread specific structure. This file descriptor should be closed when
  the thread is destroyed but due to a bug it is left open thus
  generating the leak.

  [Test Plan]

  This code generates many threads that open the mentioned socket.

  $ sudo apt install sssd build-essential
  $ cat > test_code.c < EOF
  #include <pwd.h>
  #include <unistd.h>
  #include <pthread.h>

  static void *client(void *arg)
  {
      int i = *((int *)arg);
      struct passwd pwd;
      char buf[10000];
      struct passwd *r;

      getpwuid_r(i, &pwd, buf, 10000, &r);

      return NULL;
  }

  int main(void)
  {
      pthread_t thread;
      int arg;
      void *t_ret;

      for (int i = 0; i < 1000; ++i) {
          arg = 100000+i;
          pthread_create(&thread, NULL, client, &arg);
          pthread_join(thread, &t_ret);
      }

      while (1) {
          sleep(1);
      }

      return 0;
  }
  EOF
  $ gcc -o test_code test_code.c -lpthread
  $ ./test_code

  The file descriptor leak problem can be tested by compiling this code
  as a test_code binary for example and running

  $ lsof -p `pidof test_code` | wc -l

  The count can reach more than a thousand when should not be bigger
  than around 20 normally.

  [Where problems could occur]

  The patched code correctly accesses the thread specific structure to
  get the file descriptor and close the socket. Previously it just
  considered the structure was null and did nothing. The only new
  problems that could occur are related to the closing of the socket but
  that would be not worse than the previous situation.

  [Other Info]

  This bug only affects Noble. This is the original github issue that was patched:
  https://github.com/SSSD/sssd/issues/7189

  Fixed in commit:
  commit b439847bc88ad7b89f0596af822c0ffbf2a579df
  From: Sumit Bose <sbose at redhat.com>
  Date: Tue, 23 Jan 2024 09:28:26 +0100
  Subject: sss-client: handle key value in destructor
  Link: https://github.com/SSSD/sssd/commit/b439847

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2085389/+subscriptions