samba.git/lib/pthreadpool, branch master

pthreadpool: Fix CID 1681387, Error handling issues (CHECKED_RETURN)

2026-02-20T08:37:17+00:00

Signed-off-by: Anoop C S 
Reviewed-by: Andreas Schneider 

Autobuild-User(master): Anoop C S 
Autobuild-Date(master): Fri Feb 20 08:37:17 UTC 2026 on atb-devel-224

lib/pthreadpool: Add some pthreadpool_pipe unit tests

2026-02-13T11:22:34+00:00

Reviewed-by: Gary Lockyer 
Signed-off-by: Noel Power 

Autobuild-User(master): Noel Power 
Autobuild-Date(master): Fri Feb 13 11:22:34 UTC 2026 on atb-devel-224

lib/pthreadpool: Incorrect error state detected for dup2 call

2026-02-13T10:19:39+00:00

Reviewed-by: Gary Lockyer 
Signed-off-by: Noel Power

lib/pthreadpool: protect jobs list from concurrent thread access

2026-01-18T15:16:59+00:00

ThreadSanitizer identifies a data race with pool->jobs with concurrent
threads in test added in previous commit.

This commit protects the pool->jobs list

(trace and line numbers are from before glue fix in previous commit)

WARNING: ThreadSanitizer: data race (pid=13574)
  Write of size 8 at 0x7b6000020260 by thread T16:
    #0 pthreadpool_tevent_job_done ../../lib/pthreadpool/pthreadpool_tevent.c:405 (pthreadpool_tevent_unit_test_san+0x407080)
    #1 tevent_common_invoke_immediate_handler ../../lib/tevent/tevent_immediate.c:190 (libtevent-private-samba.so+0x8dbf)
    #2 pthreadpool_tevent_job_fn ../../lib/pthreadpool/pthreadpool_tevent.c:351 (pthreadpool_tevent_unit_test_san+0x406bc4)
    #3 pthreadpool_server ../../lib/pthreadpool/pthreadpool.c:655 (pthreadpool_tevent_unit_test_san+0x4043bd)
    #4   (libtsan.so.0+0x323cf)

  Previous write of size 8 at 0x7b6000020260 by thread T13:
    #0 pthreadpool_tevent_job_send ../../lib/pthreadpool/pthreadpool_tevent.c:342 (pthreadpool_tevent_unit_test_san+0x406a09)
    #1 do_nested_pthread_job ../../lib/pthreadpool/test_pthreadpool_tevent.c:463 (pthreadpool_tevent_unit_test_san+0x408932)
    #2 pthreadpool_tevent_job_fn ../../lib/pthreadpool/pthreadpool_tevent.c:351 (pthreadpool_tevent_unit_test_san+0x406bc4)
    #3 pthreadpool_server ../../lib/pthreadpool/pthreadpool.c:655 (pthreadpool_tevent_unit_test_san+0x4043bd)
    #4   (libtsan.so.0+0x323cf)

  Thread T16 (tid=13591, running) created by main thread at:
    #0 pthread_create  (libtsan.so.0+0x5ed75)
    #1 pthreadpool_create_thread ../../lib/pthreadpool/pthreadpool.c:711 (pthreadpool_tevent_unit_test_san+0x4045ac)
    #2 pthreadpool_add_job ../../lib/pthreadpool/pthreadpool.c:792 (pthreadpool_tevent_unit_test_san+0x40496f)
    #3 pthreadpool_tevent_job_send ../../lib/pthreadpool/pthreadpool_tevent.c:329 (pthreadpool_tevent_unit_test_san+0x4065e2)
    #4 test_pthreadpool_tevent_job_send_multiple_3 ../../lib/pthreadpool/test_pthreadpool_tevent.c:515 (pthreadpool_tevent_unit_test_san+0x408c25)
    #5 cmocka_run_one_test_or_fixture ../../third_party/cmocka/cmocka.c:2948 (libcmocka-private-samba.so+0x6f92)
    #6 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 (libc.so.6+0x40e6b)

  Thread T13 (tid=13588, running) created by main thread at:
    #0 pthread_create  (libtsan.so.0+0x5ed75)
    #1 pthreadpool_create_thread ../../lib/pthreadpool/pthreadpool.c:711 (pthreadpool_tevent_unit_test_san+0x4045ac)
    #2 pthreadpool_add_job ../../lib/pthreadpool/pthreadpool.c:792 (pthreadpool_tevent_unit_test_san+0x40496f)
    #3 pthreadpool_tevent_job_send ../../lib/pthreadpool/pthreadpool_tevent.c:329 (pthreadpool_tevent_unit_test_san+0x4065e2)
    #4 test_pthreadpool_tevent_job_send_multiple_3 ../../lib/pthreadpool/test_pthreadpool_tevent.c:515 (pthreadpool_tevent_unit_test_san+0x408c25)
    #5 cmocka_run_one_test_or_fixture ../../third_party/cmocka/cmocka.c:2948 (libcmocka-private-samba.so+0x6f92)
    #6 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 (libc.so.6+0x40e6b)

SUMMARY: ThreadSanitizer: data race ../../lib/pthreadpool/pthreadpool_tevent.c:405 in pthreadpool_tevent_job_done

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15958
Signed-off-by: Noel Power 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Sun Jan 18 15:16:59 UTC 2026 on atb-devel-224

lib/pthreadpool: Fix possible concurrent access to pool->glue_list

2026-01-18T14:13:45+00:00

ThreadSanitizer run against tests added in previous commit
identify a race condition with pool->glue_list with concurrent
thread access

WARNING: ThreadSanitizer: data race (pid=13574)
  Read of size 8 at 0x7b2000000368 by thread T7:
    #0 pthreadpool_tevent_job_signal ../../lib/pthreadpool/pthreadpool_tevent.c:370 (pthreadpool_tevent_unit_test_san+0x406c6e)
    #1 pthreadpool_server ../../lib/pthreadpool/pthreadpool.c:657 (pthreadpool_tevent_unit_test_san+0x40443b)
    #2   (libtsan.so.0+0x323cf)

  Previous write of size 8 at 0x7b2000000368 by main thread:
    #0 pthreadpool_tevent_glue_destructor ../../lib/pthreadpool/pthreadpool_tevent.c:165 (pthreadpool_tevent_unit_test_san+0x405aed)
    #1 _tc_free_internal ../../lib/talloc/talloc.c:1158 (libtalloc-private-samba.so+0x3419)
    #2 _tc_free_internal ../../lib/talloc/talloc.c:1158 (libtalloc-private-samba.so+0x3419)
    #3 cmocka_run_one_test_or_fixture ../../third_party/cmocka/cmocka.c:2948 (libcmocka-private-samba.so+0x6f92)
    #4 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 (libc.so.6+0x40e6b)

  Location is heap block of size 120 at 0x7b2000000300 allocated by main thread:
    #0 malloc  (libtsan.so.0+0x35799)
    #1 __talloc_with_prefix ../../lib/talloc/talloc.c:783 (libtalloc-private-samba.so+0x2a99)
    #2 test_pthreadpool_tevent_job_send_multiple_2 ../../lib/pthreadpool/test_pthreadpool_tevent.c:399 (pthreadpool_tevent_unit_test_san+0x40856f)
    #3 cmocka_run_one_test_or_fixture ../../third_party/cmocka/cmocka.c:2948 (libcmocka-private-samba.so+0x6f92)
    #4 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 (libc.so.6+0x40e6b)

  Thread T7 (tid=13582, running) created by main thread at:
    #0 pthread_create  (libtsan.so.0+0x5ed75)
    #1 pthreadpool_create_thread ../../lib/pthreadpool/pthreadpool.c:711 (pthreadpool_tevent_unit_test_san+0x4045ac)
    #2 pthreadpool_add_job ../../lib/pthreadpool/pthreadpool.c:792 (pthreadpool_tevent_unit_test_san+0x40496f)
    #3 pthreadpool_tevent_job_send ../../lib/pthreadpool/pthreadpool_tevent.c:329 (pthreadpool_tevent_unit_test_san+0x4065e2)
    #4 test_pthreadpool_tevent_job_send_multiple_2 ../../lib/pthreadpool/test_pthreadpool_tevent.c:423 (pthreadpool_tevent_unit_test_san+0x4086b2)
    #5 cmocka_run_one_test_or_fixture ../../third_party/cmocka/cmocka.c:2948 (libcmocka-private-samba.so+0x6f92)
    #6 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 (libc.so.6+0x40e6b)

SUMMARY: ThreadSanitizer: data race ../../lib/pthreadpool/pthreadpool_tevent.c:370 in pthreadpool_tevent_job_signal

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15958
Signed-off-by: Noel Power 
Reviewed-by: Stefan Metzmacher

lib/pthreadpool: fix free of already freed glue object

2026-01-18T14:13:45+00:00

The lines are a bit skewed from actual sources (due to temp
debug lines) but I have inserted the relevant source code below

basically if we free ev_link then this will free the glue object, so
deleting the glue object on the next line is not what we want to do.

==14263== Invalid read of size 4
==14263==    at 0x4D13E90: talloc_chunk_from_ptr (talloc.c:527)
==14263==    by 0x4D1621E: _talloc_free (talloc.c:1770)
  249 #ifdef HAVE_PTHREAD
  250	glue->tctx = tevent_threaded_context_create(glue, ev);
  251	if (glue->tctx == NULL) {
  252		TALLOC_FREE(ev_link);
* 253		TALLOC_FREE(glue);
  254		return ENOMEM;
  250	}
==14263==    by 0x51FA0AF: pthreadpool_tevent_register_ev (pthreadpool_tevent.c:253)
==14263==    by 0x51FA302: pthreadpool_tevent_job_send (pthreadpool_tevent.c:324)
==14263==    by 0x4B01E68: vfswrap_fsync_send (vfs_default.c:1104)
==14263==    by 0x49CD9B1: smb_vfs_call_fsync_send (vfs.c:1998)
==14263==    by 0x49CDBF9: smb_vfs_fsync_sync (vfs.c:2057)
==14263==    by 0x494B1E5: sync_file (fileio.c:320)
==14263==    by 0x497CC77: reply_flush (reply.c:5398)
==14263==    by 0x49E28CB: switch_message (process.c:1726)
==14263==    by 0x49E2AA4: construct_reply (process.c:1762)
==14263==    by 0x49E37F8: process_smb (process.c:2017)
==14263==  Address 0xcb415d0 is 0 bytes inside a block of size 144 free'd
==14263==    at 0x484494B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14263==    by 0x4D14F81: _tc_free_internal (talloc.c:1222)
==14263==    by 0x4D15025: _talloc_free_internal (talloc.c:1248)
==14263==    by 0x4D162ED: _talloc_free (talloc.c:1792)

  190 static int pthreadpool_tevent_glue_link_destructor(
  191 	struct pthreadpool_tevent_glue_ev_link *ev_link)
  192 {
* 193 	TALLOC_FREE(ev_link->glue);
  194 	return 0;
  195 }
==14263==    by 0x51F9EC3: pthreadpool_tevent_glue_link_destructor (pthreadpool_tevent.c:193)
==14263==    by 0x4D14CA9: _tc_free_internal (talloc.c:1158)
==14263==    by 0x4D15025: _talloc_free_internal (talloc.c:1248)
==14263==    by 0x4D162ED: _talloc_free (talloc.c:1792)
  249 #ifdef HAVE_PTHREAD
  250   glue->tctx = tevent_threaded_context_create(glue, ev);
  251   if (glue->tctx == NULL) {
* 252           TALLOC_FREE(ev_link);
  253           TALLOC_FREE(glue);
  254           return ENOMEM;
  250   }
==14263==    by 0x51FA08D: pthreadpool_tevent_register_ev (pthreadpool_tevent.c:252)
==14263==    by 0x51FA302: pthreadpool_tevent_job_send (pthreadpool_tevent.c:324)
==14263==    by 0x4B01E68: vfswrap_fsync_send (vfs_default.c:1104)
==14263==    by 0x49CD9B1: smb_vfs_call_fsync_send (vfs.c:1998)
==14263==  Block was alloc'd at
==14263==    at 0x4841984: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14263==    by 0x4D14339: __talloc_with_prefix (talloc.c:783)
==14263==    by 0x4D144D3: __talloc (talloc.c:825)
==14263==    by 0x4D1486C: _talloc_named_const (talloc.c:982)
==14263==    by 0x4D1734D: _talloc_zero (talloc.c:2421)
==14263==    by 0x51F9F46: pthreadpool_tevent_register_ev (pthreadpool_tevent.c:222)
==14263==    by 0x51FA302: pthreadpool_tevent_job_send (pthreadpool_tevent.c:324)
==14263==    by 0x4B01E68: vfswrap_fsync_send (vfs_default.c:1104)
==14263==    by 0x49CD9B1: smb_vfs_call_fsync_send (vfs.c:1998)
==14263==    by 0x49CDBF9: smb_vfs_fsync_sync (vfs.c:2057)
==14263==    by 0x494B1E5: sync_file (fileio.c:320)
==14263==    by 0x497CC77: reply_flush (reply.c:5398)
==14263==
==14263== Invalid read of size 4
==14263==    at 0x4D13EAE: talloc_chunk_from_ptr (talloc.c:528)
==14263==    by 0x4D1621E: _talloc_free (talloc.c:1770)
==14263==    by 0x51FA0AF: pthreadpool_tevent_register_ev (pthreadpool_tevent.c:253)
==14263==    by 0x51FA302: pthreadpool_tevent_job_send (pthreadpool_tevent.c:324)
==14263==    by 0x4B01E68: vfswrap_fsync_send (vfs_default.c:1104)
==14263==    by 0x49CD9B1: smb_vfs_call_fsync_send (vfs.c:1998)
==14263==    by 0x49CDBF9: smb_vfs_fsync_sync (vfs.c:2057)
==14263==    by 0x494B1E5: sync_file (fileio.c:320)
==14263==    by 0x497CC77: reply_flush (reply.c:5398)
==14263==    by 0x49E28CB: switch_message (process.c:1726)
==14263==    by 0x49E2AA4: construct_reply (process.c:1762)
==14263==    by 0x49E37F8: process_smb (process.c:2017)
==14263==  Address 0xcb415d0 is 0 bytes inside a block of size 144 free'd
==14263==    at 0x484494B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-l

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15957
Signed-off-by: Noel Power 
Reviewed-by: Stefan Metzmacher

Add unit cmocka tests for pthreadpool_tevent

2026-01-18T14:13:45+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15958
Signed-off-by: Noel Power 
Reviewed-by: Stefan Metzmacher

Add basic cmocka unit tests for pthreadpool

2026-01-18T14:13:45+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15958
Pair-Programmed-With: Andreas Schneider 
Signed-off-by: Noel Power 
Signed-off-by: Andreas Schneider 
Reviewed-by: Stefan Metzmacher

Add missing include needed for cmocka.h

2025-10-17T11:12:29+00:00

This will be required in future.

Signed-off-by: Andreas Schneider 
Reviewed-by: Anoop C S

lib:pthreadpool: Fix code spelling

2023-04-11T09:06:36+00:00

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider 
Reviewed-by: Joseph Sutton