From 36d2766a821a1e94518a52da5a60e39822c43706 Mon Sep 17 00:00:00 2001 From: Gary Lockyer Date: Wed, 7 Jan 2026 10:23:33 +1300 Subject: [PATCH] s3:windinbd fix crash Fixes: winbindd[306061]: Bad talloc magic value - unknown value winbindd[306061]: ========================================================= winbindd[306061]: INTERNAL ERROR: Bad talloc magic value - unknown value in winbindd () () pid A race condition in source3/windbindd/winbindd_util.c::terminate_child between the child socket closing, and the destructor de-registering the child socket from epoll. If the socket closes before it is de-registered from epoll, the event is added to the epoll rdllink and will be retrieved when epoll_wait is next called. However monitor_fde has been deallocated and we get the observed failure. Moving the TALLOC_FREE before the kill ensures that the child socket has been de-registered from epoll before it closes. Signed-off-by: Gary Lockyer --- source3/winbindd/winbindd_util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c index 2e86336322c..bc2ad712fdb 100644 --- a/source3/winbindd/winbindd_util.c +++ b/source3/winbindd/winbindd_util.c @@ -978,13 +978,13 @@ static void terminate_child(struct tevent_req *subreq) TALLOC_FREE(subreq); if (c->pid != 0) { + TALLOC_FREE(c->monitor_fde); kill(c->pid, SIGTERM); c->pid = 0; if (c->sock != -1) { close(c->sock); } c->sock = -1; - TALLOC_FREE(c->monitor_fde); } c = NULL; -- 2.43.0