| commit | 6a2371cda9708cc0e18323ad66789cf5704dd54d | |
| author | Volker Lendecke <vl@samba.org> | |
| Fri, 25 Jul 2008 10:08:03 +0000 (25 12:08 +0200) | ||
| committer | Michael Adam <obnox@samba.org> | |
| Wed, 30 Jul 2008 11:31:32 +0000 (30 13:31 +0200) | ||
| tree | 0aa9ac34c0ecafa6f20b6b5e994a175bbd228126 | treesnapshot (tar.gz zip) |
| parent | a47ef0ecc80879a0cef98a51bfb6974267703e1f | commitdiff |
Fix a race condition in winbind leading to a crash
When SIGCHLD handling is delayed for some reason, sending a request to a child
can fail early because the child has died already. In this case
async_main_request_sent() directly called the continuation function without
properly removing the malfunctioning child process and the requests in the
queue. The next request would then crash in the DLIST_ADD_END() in
async_request() because the request pending for the child had been
talloc_free()'ed and yet still was referenced in the list.
This one is *old*...
Volker
(cherry picked from commit 8691709626b0d461de91b8fc9d10c730d1f183dd)
(cherry picked from commit d1db27e6c94cb283fb70d6dbf531c65829d0f460)
When SIGCHLD handling is delayed for some reason, sending a request to a child
can fail early because the child has died already. In this case
async_main_request_sent() directly called the continuation function without
properly removing the malfunctioning child process and the requests in the
queue. The next request would then crash in the DLIST_ADD_END() in
async_request() because the request pending for the child had been
talloc_free()'ed and yet still was referenced in the list.
This one is *old*...
Volker
(cherry picked from commit 8691709626b0d461de91b8fc9d10c730d1f183dd)
(cherry picked from commit d1db27e6c94cb283fb70d6dbf531c65829d0f460)
| source/winbindd/winbindd_dual.c | diffblobblamehistory |