[PATCH] ctdb-recovery-helper: Deregister message handler in error paths (bug 13188)

Martin Schwenke martin at meltin.net
Wed Dec 13 06:07:13 UTC 2017


On Wed, 13 Dec 2017 16:51:13 +1100, Amitay Isaacs via samba-technical
<samba-technical at lists.samba.org> wrote:

> If PULL_DB control times out but the remote node is still sending the
> data, then the tevent_req for pull_database_send will be freed without
> removing the message handler.  So when the data is received, srvid
> handler will be called and it will try to access tevent_req which will
> result in use-after-free and abort.
> 
> Please review and push.

Reviewed-by: Martin Schwenke <martin at meltin.net>

Pushed...

peace & happiness,
martin



More information about the samba-technical mailing list