Description of problem:

The EPEL package libtalloc contains the libraries libtalloc-compat1-2.0.1.so and libtalloc.so.2.0.1. The RHEL package libtalloc contains libtalloc.so.1. So, when you install samba3x (which is dependand on libtalloc) and have EPEL enabled, the new package of the EPEL repository is chosen instead of the old RHEL package.
 
Unfortunately, libtalloc-compat1-2.0.1.so (alias libtalloc.so.1) is incompatible with samba3x. When you look at the source code of the samba3x package, you see that its libtalloc is substantially newer then the compat-library provided by the EPEL package. I don't know whether samba3x should generate libtalloc.so.2 instead or if the compatibility library is broken - in the end they don't fit together.
 
The effect is subtile: timed events aren't automatically destructed anymore, so whenever a timed event is handled, smbd stucks in an infinite loop, calling the event handler again and again. It seems that this problem mainly occurs if you are using LDAP as the passdb backend. In the end, smbd runs for a couple of minutes and then suddenly freezes.

Version-Release number of selected component (if applicable):

libtalloc.2.0.1-2.el5

How reproducible:

Fully reproducible.

Steps to Reproduce:

1. activate EPEL repository in your RHEL 5.5 installation (without yum-priorities!)
2. install samba3x
3. configure samba, using ldapsam backend (though the problem should always occur)
4. start smbd
5. wait 3 minutes
6. issue any "net" command, e.g. "net rpc rights list accounts"
7. smbd gets 100% load, net command aborts after a timeout

I used x86_64, but that shouldn't matter according to my findings.
  
Actual results:

smbd is stuck in a infinite loop. Activating log level "all:10" in /etc/samba/smb.conf shows following output in "/var/log/smbd":

[2010/05/26 11:15:13, 10] lib/events.c:run_events(231)
  Running event "smbldap_idle_fn" 2aeae0de73c0
[2010/05/26 11:15:13, 10] lib/smbldap.c:smbldap_idle_fn(1641)
  ldap connection not connected...

These two lines are repeated forever at a very high rate.

Reason is that smbldap_idle_fn doesn't unregister the timed event as TALLOC_FREE doesn't call the destructor.

Expected results:

Well, the event handler should only get called once and smbd should keep reacting to client requests.

Additional info:

There are two solutions:
1. use yum priorities, so libtalloc of EPEL is ignored, and do a downgrade
2. replace EPEL's source code of libtalloc-compat1-2.0.1.so with the one provided by samba3x

Looking at the source code of samba3x, you see that its libtalloc calls the user-provided destructor in talloc_free, whereas the compat-library of EPEL's libtalloc package only unlinks the memory without calling any destructor. So,  libtalloc-compat1-2.0.1.so seems to be much too old for samba3x.