heimdal-kdc: kdc process leaks memory
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | heimdal (Debian) |
Fix Released
|
Unknown
|
||
| | heimdal (Ubuntu) |
Undecided
|
Unassigned | ||
| | Trusty |
High
|
Brian Murray | ||
| | Utopic |
High
|
Brian Murray | ||
Bug Description
SRU information appears in comment #7:
https:/
I have a KDC running Trusty Tahr. The machine has been up for 74 days and the kdc process has allocated almost all of the 8GB RAM available to the machine.
When asking about this on heimdal-discuss, GALAMBOS Daniel pointed me to a relevant bug report (and fix) for Debian:
https:/
It seems likely this is the same problem I am experiencing.
| Patrik Lundin (patrik-lundin) wrote : | #1 |
| Launchpad Janitor (janitor) wrote : | #2 |
Status changed to 'Confirmed' because the bug affects multiple users.
| Changed in heimdal (Ubuntu): | |
| status: | New → Confirmed |
The attachment "heimdal-
[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]
| tags: | added: patch |
| Daniel Holbach (dholbach) wrote : | #4 |
This is fixed in vivid.
| Changed in heimdal (Ubuntu): | |
| status: | Confirmed → Fix Released |
| Changed in heimdal (Debian): | |
| status: | Unknown → Fix Released |
| Patrik Lundin (patrik-lundin) wrote : | #5 |
I would appreciate if someone could take a look at the affected LTS distributions.
| Brian Murray (brian-murray) wrote : | #6 |
The Stable Release Updates team will want to see the description of the bug updated for the SRU process, in particular to see a test case. http://
Thanks for working on this and the patch looks good!
| Patrik Lundin (patrik-lundin) wrote : | #7 |
Thanks for the pointer Brian, see SRU format below:
[Impact]
* Effects of the bug on users
The kdc process leaks memory which means the users will need to restart the service when enough time has passed.
* Justification for backporting the fix to the stable release
The kdc is a long lived process, which means this leak will eventually be hit by anyone. I would not regard the current package as "stable".
* Explanation of how the upload fixes this bug
https:/
[Test Case]
* Install heimdal-kdc package
* Modify /etc/krb5.conf so you use the same machine for AS-REQ:
---
[realms]
YOUR.REALM = {
kdc = your-local-
}
---
* Add "test" user with password "test"
kadmin -l --use-defaults test
<email address hidden>'s Password:
Verify password - <email address hidden>'s Password:
* Note how much RAM is currently being used by the kdc process:
---
# ps auxww | grep kdc | grep -v grep
root 832 0.0 0.1 79948 2768 ? S 09:22 0:00 /usr/lib/
---
* Perform a bunch of requests against it:
---
# for request in {1..20000}; do echo test | kinit --password-
---
* Note how much RAM is used after the test has been completed:
# ps auxww | grep kdc | grep -v grep
root 832 2.1 0.4 85660 9104 ? S 09:22 0:27 /usr/lib/
---
* Install the new packages
* Reboot the machine
* Get a fresh RAM measurement:
---
# ps auxww | grep kdc | grep -v grep
root 864 0.0 0.1 79948 2764 ? S 11:01 0:00 /usr/lib/
---
* Run test again
---
# for request in {1..20000}; do echo test | kinit --password-
---
* Note that much less memory is used now:
---
# ps auxww | grep kdc | grep -v grep
root 864 1.8 0.1 79948 3468 ? S 11:01 0:27 /usr/lib/
---
| Patrik Lundin (patrik-lundin) wrote : | #10 |
Thanks for the pointer Brian, see SRU format below:
[Impact]
* Effects of the bug on users
The kdc process leaks memory which means the users will need to restart the service when enough time has passed.
* Justification for backporting the fix to the stable release
The kdc is a long lived process, which means this leak will eventually be hit by anyone. I would not regard the current package as "stable".
* Explanation of how the upload fixes this bug
https:/
[Test Case]
* Install heimdal-kdc package
* Modify /etc/krb5.conf so you use the same machine for AS-REQ:
---
[realms]
YOUR.REALM = {
kdc = your-local-
}
---
* Add a user with name "test" and password "test"
---
# kadmin -l --use-defaults test
<email address hidden>'s Password:
Verify password - <email address hidden>'s Password:
#
---
* Note how much RAM is currently being used by the kdc process:
---
# ps auxww | grep kdc | grep -v grep
root 832 0.0 0.1 79948 2768 ? S 09:22 0:00 /usr/lib/
---
* Perform a bunch of requests against it:
---
# for request in {1..20000}; do echo test | kinit --password-
---
* Note how much RAM is used after the test has been completed:
# ps auxww | grep kdc | grep -v grep
root 832 2.1 0.4 85660 9104 ? S 09:22 0:27 /usr/lib/
---
* Install the new packages
* Reboot the machine
* Get a fresh RAM measurement:
---
# ps auxww | grep kdc | grep -v grep
root 864 0.0 0.1 79948 2764 ? S 11:01 0:00 /usr/lib/
---
* Run test again
---
# for request in {1..20000}; do echo test | kinit --password-
---
* Note that much less memory is used now:
---
# ps auxww | grep kdc | grep -v grep
root 864 1.8 0.1 79948 3468 ? S 11:01 0:27 /usr/lib/
---
| Patrik Lundin (patrik-lundin) wrote : | #11 |
Sorry for the double-post, launchpad threw an error the first few times i tried submitting it.
| Changed in heimdal (Ubuntu Trusty): | |
| status: | New → In Progress |
| Changed in heimdal (Ubuntu Utopic): | |
| assignee: | nobody → Brian Murray (brian-murray) |
| Changed in heimdal (Ubuntu Trusty): | |
| assignee: | nobody → Brian Murray (brian-murray) |
| Changed in heimdal (Ubuntu Utopic): | |
| status: | New → In Progress |
| Changed in heimdal (Ubuntu Trusty): | |
| importance: | Undecided → High |
| Changed in heimdal (Ubuntu Utopic): | |
| importance: | Undecided → High |
| Brian Murray (brian-murray) wrote : | #12 |
I've uploaded the debdif for Trusty, do you want to create one for Utopic also or shall I?
| Patrik Lundin (patrik-lundin) wrote : | #13 |
If you could handle Utopic that would be great, I do not have the infrastructure in place to work on it right now.
Hello Patrik, or anyone else affected,
Accepted heimdal into trusty-proposed. The package will build now and be available at https:/
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-
Further information regarding the verification process can be found at https:/
| Changed in heimdal (Ubuntu Trusty): | |
| status: | In Progress → Fix Committed |
| tags: | added: verification-needed |
| description: | updated |
| Brian Murray (brian-murray) wrote : | #15 |
I've also uploaded this to the Utopic queue.
| Timo Aaltonen (tjaalton) wrote : | #16 |
Hello Patrik, or anyone else affected,
Accepted heimdal into utopic-proposed. The package will build now and be available at https:/
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-
Further information regarding the verification process can be found at https:/
| Changed in heimdal (Ubuntu Utopic): | |
| status: | In Progress → Fix Committed |
| Patrik Lundin (patrik-lundin) wrote : | #17 |
I have now installed the following packages on Trusty (by asking for heimdal-kdc):
Do you want to continue? [Y/n]
Get:1 http://
Get:2 http://
Get:3 http://
Get:4 http://
Get:5 http://
Get:6 http://
Get:7 http://
Get:8 http://
Get:9 http://
Get:10 http://
Get:11 http://
Get:12 http://
Get:13 http://
Fetched 667 kB in 2s (284 kB/s)
I can confirm these packages fix the leak on Trusty.
| tags: | added: verification-done |
| Patrik Lundin (patrik-lundin) wrote : | #18 |
I added the verification-done tag. I did not remove the verification-needed tag because I have no looked at Utopic.
| tags: |
added: verification-done-trusty verification-needed-utopic removed: verification-done verification-needed |
| Launchpad Janitor (janitor) wrote : | #19 |
This bug was fixed in the package heimdal - 1.6~git20131207
---------------
heimdal (1.6~git2013120
* Add 048_kdc_memleak patch based on Debian bug #746486. LP: #1422359
-- Patrik Lundin <email address hidden> Tue, 03 Mar 2015 08:16:15 -0800
| Changed in heimdal (Ubuntu Trusty): | |
| status: | Fix Committed → Fix Released |
The verification of the Stable Release Update for heimdal has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.
The fix for this bug has been awaiting testing feedback in the -proposed repository for utopic for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now, the package will be removed from the -proposed repository.
| tags: | added: removal-candidate |
| Launchpad Janitor (janitor) wrote : | #22 |
This bug was fixed in the package heimdal - 1.6~rc2+
---------------
heimdal (1.6~rc2+
* Add 051_kdc_memleak patch based on Debian bug #746486. LP: #1422359
-- Patrik Lundin <email address hidden> Wed, 04 Mar 2015 16:16:19 -0800
| Changed in heimdal (Ubuntu Utopic): | |
| status: | Fix Committed → Fix Released |
Below is a patch that attempts to fix the same issue that was reported to Debian. I have only build-tested the diff.