sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00
Code

lib: Fix a shutdown crash with "clustering = yes"

Browse Source 
This is a bit confusing now, sorry for that:

register_msg_pool_usage() in the ctdb case uses
messaging_ctdb_register_tevent_context(), which talloc_reference()s
the central struct messaging_ctdb_fde_ev of the
messaging_ctdb_context. In messaging_reinit(), we talloc_free only one
of those references and allocate a new messaging_ctdb_fde_ev. The
remaining messaging_ctdb_fde_ev should have been deleted as well, but
due to the second reference this does not happen. When doing the
shutdown messaging_ctdb_fde_ev_destructor() is called twice, once on
the properly reinitialized fde_ev, and once much later on the leftover
one which references invalid data structures.

By the way, this is not a problem with talloc_reference(), this would
have happened with explicit refcounting too.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14281

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Tue Feb 18 13:05:53 UTC 2020 on sn-devel-184
This commit is contained in:
Volker Lendecke 2020-02-11 22:10:32 +01:00 committed by Björn Baumbach
parent 7209357f9b
commit f1577c2bc1
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
source3/lib/messages.c
View File

@ -602,7 +602,7 @@ static NTSTATUS messaging_init_internal(TALLOC_CTX *mem_ctx,
/* Register some debugging related messages */
register_msg_pool_usage(ctx, ctx);
register_msg_pool_usage(ctx->per_process_talloc_ctx, ctx);
register_dmalloc_msgs(ctx);
debug_register_msgs(ctx);
@ -699,6 +699,7 @@ NTSTATUS messaging_reinit(struct messaging_context *msg_ctx)
}
server_id_db_reinit(msg_ctx->names_db, msg_ctx->id);
register_msg_pool_usage(msg_ctx->per_process_talloc_ctx, msg_ctx);
return NT_STATUS_OK;
}