From 5340540763379314e70b7765358372d25d553ac5 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 15 Sep 2016 09:53:44 -0700 Subject: [PATCH] s3: lib: poll_funcs. Ensure struct poll_funcs_tevent_context is owned by the struct tevent_context *ev. If the tevent_context is freed with active watchers or timeouts, the poll_funcs_tevent_context_destructor() NULLs out the context pointer and handles, allowing safe teardown. Signed-off-by: Jeremy Allison --- lib/poll_funcs/poll_funcs_tevent.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/lib/poll_funcs/poll_funcs_tevent.c b/lib/poll_funcs/poll_funcs_tevent.c index 3059ebc..efff6c9 100644 --- a/lib/poll_funcs/poll_funcs_tevent.c +++ b/lib/poll_funcs/poll_funcs_tevent.c @@ -474,6 +474,8 @@ struct poll_funcs *poll_funcs_init_tevent(TALLOC_CTX *mem_ctx) static int poll_funcs_state_destructor(struct poll_funcs_state *state) { size_t num_watches = talloc_array_length(state->watches); + size_t num_contexts = talloc_array_length(state->contexts); + size_t num_timeouts = talloc_array_length(state->timeouts); size_t i; /* * Make sure the watches are cleared before the contexts. The watches @@ -482,6 +484,12 @@ static int poll_funcs_state_destructor(struct poll_funcs_state *state) for (i=0; iwatches[i]); } + for (i=0; itimeouts[i]); + } + for (i=0; icontexts[i]); + } return 0; } @@ -523,7 +531,7 @@ static int poll_funcs_tevent_context_destructor( struct poll_funcs_tevent_context *ctx); static struct poll_funcs_tevent_context *poll_funcs_tevent_context_new( - TALLOC_CTX *mem_ctx, struct poll_funcs_state *state, + struct poll_funcs_state *state, struct tevent_context *ev, unsigned slot) { struct poll_funcs_tevent_context *ctx; @@ -531,7 +539,7 @@ static struct poll_funcs_tevent_context *poll_funcs_tevent_context_new( size_t num_timeouts = talloc_array_length(state->timeouts); size_t i; - ctx = talloc(mem_ctx, struct poll_funcs_tevent_context); + ctx = talloc(ev, struct poll_funcs_tevent_context); if (ctx == NULL) { return NULL; } @@ -631,7 +639,7 @@ void *poll_funcs_tevent_register(TALLOC_CTX *mem_ctx, struct poll_funcs *f, } if (state->contexts[slot] == NULL) { state->contexts[slot] = poll_funcs_tevent_context_new( - state->contexts, state, ev, slot); + state, ev, slot); if (state->contexts[slot] == NULL) { goto fail; } -- 2.8.0.rc3.226.g39d4020