[PATCH] Version 2: Patchset for bug #10344 - SessionLogoff on a signed connection with an outstanding notify request crashes smbd.

[Jeremy Allison]

On Wed, Mar 12, 2014 at 04:41:32PM +0100, Stefan (metze) Metzmacher wrote:
> 
> It's just a queue as in real life...
> Only the first one is served and when he leaves the next one comes
> and anyone else can silently join or leave the queue.

Yes, but the events don't actually
necessarily complete in that order,
do they. It only works due to the
fact that there are no real callbacks
triggered on any object in the queue
except for the last one. I think (at
least in the case used in your patch)
this is depending on a side-effect.

You're turning a set of events that
can asynchronously complete in any
order into a queue - which underneath
it all they're really not. Yeah,
your code makes 'em end up that
way, but to do that correctly
*requires* knowledge of the
internals of lib/tevent/tevent_queue.c

If anyone else tried to do the same
thing in a sightly different use-case
I fear for the result :-).

> There's also nobody looking into the complex talloc details
> in order to just use it:-)

I had to :-).

> It's all complex code hidden behind a hopefully sane api.

See my note to Andreas for what I think about that :-).

Jeremy.