spoolss talloc problem

[simo]

On Mon, 2011-08-08 at 18:42 +1000, tridge at samba.org wrote:
> Hi Simo,
> 
> I finally got the problem reproduced, and spent a few hours on it
> today. I eventually concluded that the problem is that the sibling
> list becomes invalid during a recursive free, and that is why finding
> the parent gives a valgrind error.
> 
> The fix I'm testing at the moment is very simple:
> 
>   http://git.samba.org/?p=tridge/samba.git;a=commitdiff;h=d24af812d76059c2f3b917b791c77175b388811a
> 
> it just ensures that a talloc chunk that is part way through being
> freed doesn't have an invalid tc->prev pointer.
> 
> I'm still testing the fix, but it does seem to fix your issue. It is
> also faster than the existing code (as we no longer call the expensive
> talloc_parent_chunk() call when we don't need it).
> 
> Please test.

Cool, and I have to say: I was so close ... I knew the sibling list was
faulty, too bad I couldn't create a reproducer.
Were you able to create a talloc test that reproduces the issue ?

Simo.

-- 
Simo Sorce
Samba Team GPL Compliance Officer <simo at samba.org>
Principal Software Engineer at Red Hat, Inc. <simo at redhat.com>