mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
c9cced0322
The valgrind error happened in poll_funcs_tevent_handle_destructor in if (handle->ctx->refcount == 0) handle->ctx was already gone at the time this destructor was called. It happened because during messaging_init the messaging_dgm subsystem was free'ed. The unix_msg context and the poll_funcs_tevent_context are children of messaging_dgm_context. How was poll_funcs_tevent_handle_destructor still called? While working on the new notify subsystem I've added some messaging_read_send tevent_reqs, which register themselves with the dgm_context via messaging_dgm_register_tevent_context. They were not gone yet. When later these were also run down due to another talloc_free somewhere else, this destructor referenced dead memory. This code now protects the poll_funcs_tevent_handle against the poll_funcs_tevent_context going away first with the loop for (h = ctx->handles; h != NULL; h = h->next) { h->ctx = NULL; } in poll_funcs_tevent_context_destructor together with if (handle->ctx == NULL) { return 0; } in poll_funcs_tevent_handle_destructor. A side-effect of this code is that messaging_read_send request won't be satisfied anymore after a reinit_after_fork kicked in. But I think this is the right thing anyway: Every process should register its own message handlers explicitly. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> |
||
---|---|---|
.. | ||
poll_funcs_tevent.c | ||
poll_funcs_tevent.h | ||
poll_funcs.h | ||
wscript_build |