svn commit: samba r22629 - in branches/SAMBA_4_0/source/lib/messaging: .

[metze at samba.org]

Author: metze
Date: 2007-05-01 09:55:36 +0000 (Tue, 01 May 2007)
New Revision: 22629

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22629

Log:
if irpc gets freed within event_loop_once() we crash...
so deferr the freeing

metze
Modified:
   branches/SAMBA_4_0/source/lib/messaging/irpc.h
   branches/SAMBA_4_0/source/lib/messaging/messaging.c


Changeset:
Modified: branches/SAMBA_4_0/source/lib/messaging/irpc.h
===================================================================
--- branches/SAMBA_4_0/source/lib/messaging/irpc.h	2007-05-01 09:06:25 UTC (rev 22628)
+++ branches/SAMBA_4_0/source/lib/messaging/irpc.h	2007-05-01 09:55:36 UTC (rev 22629)
@@ -69,6 +69,7 @@
 	void *r;
 	NTSTATUS status;
 	BOOL done;
+	BOOL reject_free;
 	TALLOC_CTX *mem_ctx;
 	struct {
 		void (*fn)(struct irpc_request *);

Modified: branches/SAMBA_4_0/source/lib/messaging/messaging.c
===================================================================
--- branches/SAMBA_4_0/source/lib/messaging/messaging.c	2007-05-01 09:06:25 UTC (rev 22628)
+++ branches/SAMBA_4_0/source/lib/messaging/messaging.c	2007-05-01 09:55:36 UTC (rev 22629)
@@ -773,7 +773,14 @@
 */
 static int irpc_destructor(struct irpc_request *irpc)
 {
-	idr_remove(irpc->msg_ctx->idr, irpc->callid);
+	if (irpc->callid != -1) {
+		idr_remove(irpc->msg_ctx->idr, irpc->callid);
+		irpc->callid = -1;
+	}
+
+	if (irpc->reject_free) {
+		return -1;
+	}
 	return 0;
 }
 
@@ -866,11 +873,16 @@
 
 	NT_STATUS_HAVE_NO_MEMORY(irpc);
 
+	irpc->reject_free = true;
+
 	while (!irpc->done) {
 		if (event_loop_once(irpc->msg_ctx->event.ev) != 0) {
 			return NT_STATUS_CONNECTION_DISCONNECTED;
 		}
 	}
+
+	irpc->reject_free = false;
+
 	status = irpc->status;
 	talloc_free(irpc);
 	return status;