When running Samba RPC daemons in FreeIPA environment, EPMAPPER leaks memory due to use of a wrong memory context that has longer lifetime than a connection context where this memory was supposed to be bound to. This leads to IPA domain controller enabled for trust to Active Directory to eventually exhaust memory and get crashed. After this, no access from Windows side is possible anymore until smb processes are restarted. Upstream bug https://bugzilla.samba.org/show_bug.cgi?id=14675 covers the same issue with a print server with a lot of print queues, the cause is the same. The issue exists for quite some time in Samba but was only noticed in last few months. In Fedora 33 it crashes due to oom killer but the same happens with other Fedora versions as Samba code there has the same issue. Mar 03 17:33:58 id.vda.li systemd[1]: Starting Samba SMB Daemon... [...] Mar 03 17:33:59 id.vda.li smbd[1486]: [2021/03/03 17:33:59.486490, 0] ../../lib/util/become_daemon.c:135(daemon_ready) Mar 03 17:33:59 id.vda.li systemd[1]: Started Samba SMB Daemon. Mar 03 17:33:59 id.vda.li smbd[1486]: daemon_ready: daemon 'smbd' finished starting up and ready to serve connections [...] Mar 08 03:15:57 id.vda.li systemd[1]: smb.service: A process of this unit has been killed by the OOM killer. Mar 08 03:15:57 id.vda.li systemd[1]: smb.service: Failed with result 'oom-kill'. Mar 08 03:15:57 id.vda.li systemd[1]: smb.service: Consumed 2min 51.659s CPU time. in this case it took a week to exhaust 4GB RAM and some swap on this server.
Proposed as a Freeze Exception for 34-final by Fedora user abbra using the blocker tracking app because: Memory exhaustion in Samba may lead to a crash on FreeIPA domain controller, rendering its operations towards trusted Active Directory domains non-working.
FEDORA-2021-9e28431266 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-9e28431266
FEDORA-2021-58fd0387e2 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2021-58fd0387e2
FEDORA-2021-9e28431266 has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-9e28431266` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-9e28431266 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2021-58fd0387e2 has been pushed to the Fedora 33 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-58fd0387e2` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-58fd0387e2 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Discussed during the 2021-04-12 blocker review meeting: [1] The decision to classify this bug as an RejectedFreezeException was made: "No justification has been provided for why this needs a freeze exception and cannot just be a 0-day update." [1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2021-04-12/f34-blocker-review.2021-04-12-16.02.log.txt
Discussed during the 2021-04-12 blocker review meeting: [1] The decision to classify this bug as an AcceptedBlocker was made: "This is now accepted as an FE due to its impact on FreeIPA deployments, which are part of the Server DVD package set." [1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2021-04-12/f34-blocker-review.2021-04-12-16.02.log.txt
There was a typo in my previous comment, this is AcceptedFreezeException and not a AcceptedBlocker, so the correct summary follows. Discussed during the 2021-04-12 blocker review meeting: [1] The decision to classify this bug as an AcceptedFreezeException was made: "This is now accepted as an FE due to its impact on FreeIPA deployments, which are part of the Server DVD package set." [1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2021-04-12/f34-blocker-review.2021-04-12-16.02.log.txt
FEDORA-2021-9e28431266 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2021-58fd0387e2 has been pushed to the Fedora 33 stable repository. If problem still persists, please make note of it in this bug report.