heimdal-kdc: kdc process leaks memory

Bug #1422359 reported by Patrik Lundin on 2015-02-16
34
This bug affects 5 people
Affects Status Importance Assigned to Milestone
heimdal (Debian)
Fix Released
Unknown
heimdal (Ubuntu)
Undecided
Unassigned
Trusty
High
Brian Murray
Utopic
High
Brian Murray

Bug Description

SRU information appears in comment #7:
https://bugs.launchpad.net/ubuntu/+source/heimdal/+bug/1422359/comments/7

I have a KDC running Trusty Tahr. The machine has been up for 74 days and the kdc process has allocated almost all of the 8GB RAM available to the machine.

When asking about this on heimdal-discuss, GALAMBOS Daniel pointed me to a relevant bug report (and fix) for Debian:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746486

It seems likely this is the same problem I am experiencing.

Patrik Lundin (patrik-lundin) wrote :

Below is a patch that attempts to fix the same issue that was reported to Debian. I have only build-tested the diff.

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in heimdal (Ubuntu):
status: New → Confirmed

The attachment "heimdal-1.6~git20131207+dfsg-1ubuntu2" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Daniel Holbach (dholbach) wrote :

This is fixed in vivid.

Changed in heimdal (Ubuntu):
status: Confirmed → Fix Released
Changed in heimdal (Debian):
status: Unknown → Fix Released
Patrik Lundin (patrik-lundin) wrote :

I would appreciate if someone could take a look at the affected LTS distributions.

Brian Murray (brian-murray) wrote :

The Stable Release Updates team will want to see the description of the bug updated for the SRU process, in particular to see a test case. http://wiki.ubuntu.com/StableReleaseUpdates

Thanks for working on this and the patch looks good!

Patrik Lundin (patrik-lundin) wrote :

Thanks for the pointer Brian, see SRU format below:

[Impact]

* Effects of the bug on users
The kdc process leaks memory which means the users will need to restart the service when enough time has passed.

* Justification for backporting the fix to the stable release
The kdc is a long lived process, which means this leak will eventually be hit by anyone. I would not regard the current package as "stable".

* Explanation of how the upload fixes this bug
https://github.com/heimdal/heimdal/issues/93

[Test Case]

* Install heimdal-kdc package

* Modify /etc/krb5.conf so you use the same machine for AS-REQ:
---
[realms]
        YOUR.REALM = {
                kdc = your-local-machine.tld
        }
---

* Add "test" user with password "test"
kadmin -l --use-defaults test
<email address hidden>'s Password:
Verify password - <email address hidden>'s Password:

* Note how much RAM is currently being used by the kdc process:
---
# ps auxww | grep kdc | grep -v grep
root 832 0.0 0.1 79948 2768 ? S 09:22 0:00 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

* Perform a bunch of requests against it:
---
# for request in {1..20000}; do echo test | kinit --password-file=STDIN <email address hidden>; done
---

* Note how much RAM is used after the test has been completed:
# ps auxww | grep kdc | grep -v grep
root 832 2.1 0.4 85660 9104 ? S 09:22 0:27 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

* Install the new packages

* Reboot the machine

* Get a fresh RAM measurement:
---
# ps auxww | grep kdc | grep -v grep
root 864 0.0 0.1 79948 2764 ? S 11:01 0:00 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

* Run test again
---
# for request in {1..20000}; do echo test | kinit --password-file=STDIN <email address hidden>; done
---

* Note that much less memory is used now:
---
# ps auxww | grep kdc | grep -v grep
root 864 1.8 0.1 79948 3468 ? S 11:01 0:27 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

Patrik Lundin (patrik-lundin) wrote :

Thanks for the pointer Brian, see SRU format below:

[Impact]

* Effects of the bug on users
The kdc process leaks memory which means the users will need to restart the service when enough time has passed.

* Justification for backporting the fix to the stable release
The kdc is a long lived process, which means this leak will eventually be hit by anyone. I would not regard the current package as "stable".

* Explanation of how the upload fixes this bug
https://github.com/heimdal/heimdal/issues/93

[Test Case]

* Install heimdal-kdc package

* Modify /etc/krb5.conf so you use the same machine for AS-REQ:
---
[realms]
        YOUR.REALM = {
                kdc = your-local-machine.tld
        }
---

* Add a user with name "test" and password "test"
---
# kadmin -l --use-defaults test
<email address hidden>'s Password:
Verify password - <email address hidden>'s Password:
#
---

* Note how much RAM is currently being used by the kdc process:
---
# ps auxww | grep kdc | grep -v grep
root 832 0.0 0.1 79948 2768 ? S 09:22 0:00 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

* Perform a bunch of requests against it:
---
# for request in {1..20000}; do echo test | kinit --password-file=STDIN <email address hidden>; done
---

* Note how much RAM is used after the test has been completed:
# ps auxww | grep kdc | grep -v grep
root 832 2.1 0.4 85660 9104 ? S 09:22 0:27 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

* Install the new packages

* Reboot the machine

* Get a fresh RAM measurement:
---
# ps auxww | grep kdc | grep -v grep
root 864 0.0 0.1 79948 2764 ? S 11:01 0:00 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

* Run test again
---
# for request in {1..20000}; do echo test | kinit --password-file=STDIN <email address hidden>; done
---

* Note that much less memory is used now:
---
# ps auxww | grep kdc | grep -v grep
root 864 1.8 0.1 79948 3468 ? S 11:01 0:27 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---

Patrik Lundin (patrik-lundin) wrote :

Sorry for the double-post, launchpad threw an error the first few times i tried submitting it.

Changed in heimdal (Ubuntu Trusty):
status: New → In Progress
Changed in heimdal (Ubuntu Utopic):
assignee: nobody → Brian Murray (brian-murray)
Changed in heimdal (Ubuntu Trusty):
assignee: nobody → Brian Murray (brian-murray)
Changed in heimdal (Ubuntu Utopic):
status: New → In Progress
Changed in heimdal (Ubuntu Trusty):
importance: Undecided → High
Changed in heimdal (Ubuntu Utopic):
importance: Undecided → High
Brian Murray (brian-murray) wrote :

I've uploaded the debdif for Trusty, do you want to create one for Utopic also or shall I?

Patrik Lundin (patrik-lundin) wrote :

If you could handle Utopic that would be great, I do not have the infrastructure in place to work on it right now.

Hello Patrik, or anyone else affected,

Accepted heimdal into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/heimdal/1.6~git20131207+dfsg-1ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in heimdal (Ubuntu Trusty):
status: In Progress → Fix Committed
tags: added: verification-needed
description: updated
Brian Murray (brian-murray) wrote :

I've also uploaded this to the Utopic queue.

Timo Aaltonen (tjaalton) wrote :

Hello Patrik, or anyone else affected,

Accepted heimdal into utopic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/heimdal/1.6~rc2+dfsg-8ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in heimdal (Ubuntu Utopic):
status: In Progress → Fix Committed
Patrik Lundin (patrik-lundin) wrote :

I have now installed the following packages on Trusty (by asking for heimdal-kdc):

Do you want to continue? [Y/n]
Get:1 http://se.archive.ubuntu.com/ubuntu/ trusty/main krb5-config all 2.3 [23.4 kB]
Get:2 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main libhdb9-heimdal amd64 1.6~git20131207+dfsg-1ubuntu1.1 [59.2 kB]
Get:3 http://se.archive.ubuntu.com/ubuntu/ trusty/main libfile-copy-recursive-perl all 0.38-1 [20.6 kB]
Get:4 http://se.archive.ubuntu.com/ubuntu/ trusty/main update-inetd all 4.43 [19.2 kB]
Get:5 http://se.archive.ubuntu.com/ubuntu/ trusty/main openbsd-inetd amd64 0.20091229-2ubuntu3 [30.8 kB]
Get:6 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main libkadm5clnt7-heimdal amd64 1.6~git20131207+dfsg-1ubuntu1.1 [18.5 kB]
Get:7 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main libkadm5srv8-heimdal amd64 1.6~git20131207+dfsg-1ubuntu1.1 [28.8 kB]
Get:8 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main libkafs0-heimdal amd64 1.6~git20131207+dfsg-1ubuntu1.1 [15.1 kB]
Get:9 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main libkdc2-heimdal amd64 1.6~git20131207+dfsg-1ubuntu1.1 [52.8 kB]
Get:10 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main libotp0-heimdal amd64 1.6~git20131207+dfsg-1ubuntu1.1 [29.8 kB]
Get:11 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main libsl0-heimdal amd64 1.6~git20131207+dfsg-1ubuntu1.1 [13.3 kB]
Get:12 http://archive.ubuntu.com/ubuntu/ trusty-proposed/universe heimdal-clients amd64 1.6~git20131207+dfsg-1ubuntu1.1 [264 kB]
Get:13 http://archive.ubuntu.com/ubuntu/ trusty-proposed/universe heimdal-kdc amd64 1.6~git20131207+dfsg-1ubuntu1.1 [91.9 kB]
Fetched 667 kB in 2s (284 kB/s)

I can confirm these packages fix the leak on Trusty.

tags: added: verification-done
Patrik Lundin (patrik-lundin) wrote :

I added the verification-done tag. I did not remove the verification-needed tag because I have no looked at Utopic.

tags: added: verification-done-trusty verification-needed-utopic
removed: verification-done verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package heimdal - 1.6~git20131207+dfsg-1ubuntu1.1

---------------
heimdal (1.6~git20131207+dfsg-1ubuntu1.1) trusty; urgency=medium

  * Add 048_kdc_memleak patch based on Debian bug #746486. LP: #1422359
 -- Patrik Lundin <email address hidden> Tue, 03 Mar 2015 08:16:15 -0800

Changed in heimdal (Ubuntu Trusty):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for heimdal has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

The fix for this bug has been awaiting testing feedback in the -proposed repository for utopic for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now, the package will be removed from the -proposed repository.

tags: added: removal-candidate
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package heimdal - 1.6~rc2+dfsg-8ubuntu1

---------------
heimdal (1.6~rc2+dfsg-8ubuntu1) utopic; urgency=medium

  * Add 051_kdc_memleak patch based on Debian bug #746486. LP: #1422359
 -- Patrik Lundin <email address hidden> Wed, 04 Mar 2015 16:16:19 -0800

Changed in heimdal (Ubuntu Utopic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.