The Samba-Bugzilla – Attachment 12477 Details for
Bug 12272
messaging subsystem crash - poll_funcs_tevent can select the wrong slot to replace when adding a new context.
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Proposed patch for master
look32 (text/plain), 4.77 KB, created by
Jeremy Allison
on 2016-09-17 17:19:13 UTC
(
hide
)
Description:
Proposed patch for master
Filename:
MIME Type:
Creator:
Jeremy Allison
Created:
2016-09-17 17:19:13 UTC
Size:
4.77 KB
patch
obsolete
>From 40ce3214466b8f0cbc6a31901f6c7f8063dc0a47 Mon Sep 17 00:00:00 2001 >From: Ralph Boehme <slow@samba.org> >Date: Thu, 15 Sep 2016 14:19:27 +0200 >Subject: [PATCH 1/4] lib/poll_funcs: free timers in > poll_funcs_state_destructor() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272 > >Signed-off-by: Ralph Boehme <slow@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> >--- > lib/poll_funcs/poll_funcs_tevent.c | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/lib/poll_funcs/poll_funcs_tevent.c b/lib/poll_funcs/poll_funcs_tevent.c >index 3059ebc..3d79b75 100644 >--- a/lib/poll_funcs/poll_funcs_tevent.c >+++ b/lib/poll_funcs/poll_funcs_tevent.c >@@ -474,6 +474,7 @@ struct poll_funcs *poll_funcs_init_tevent(TALLOC_CTX *mem_ctx) > static int poll_funcs_state_destructor(struct poll_funcs_state *state) > { > size_t num_watches = talloc_array_length(state->watches); >+ size_t num_timeouts = talloc_array_length(state->timeouts); > size_t i; > /* > * Make sure the watches are cleared before the contexts. The watches >@@ -482,6 +483,9 @@ static int poll_funcs_state_destructor(struct poll_funcs_state *state) > for (i=0; i<num_watches; i++) { > TALLOC_FREE(state->watches[i]); > } >+ for (i=0; i<num_timeouts; i++) { >+ TALLOC_FREE(state->timeouts[i]); >+ } > return 0; > } > >-- >2.7.4 > > >From 1c80a02a350dbcb78c84b0ba2a4cae9111f165b7 Mon Sep 17 00:00:00 2001 >From: Ralph Boehme <slow@samba.org> >Date: Fri, 16 Sep 2016 17:55:56 +0200 >Subject: [PATCH 2/4] lib/poll_funcs: free contexts in > poll_funcs_state_destructor() > >This ensures the destructors get called in the proper order. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272 > >Signed-off-by: Ralph Boehme <slow@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> >--- > lib/poll_funcs/poll_funcs_tevent.c | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/lib/poll_funcs/poll_funcs_tevent.c b/lib/poll_funcs/poll_funcs_tevent.c >index 3d79b75..233e911 100644 >--- a/lib/poll_funcs/poll_funcs_tevent.c >+++ b/lib/poll_funcs/poll_funcs_tevent.c >@@ -475,6 +475,7 @@ static int poll_funcs_state_destructor(struct poll_funcs_state *state) > { > size_t num_watches = talloc_array_length(state->watches); > size_t num_timeouts = talloc_array_length(state->timeouts); >+ size_t num_contexts = talloc_array_length(state->contexts); > size_t i; > /* > * Make sure the watches are cleared before the contexts. The watches >@@ -486,6 +487,9 @@ static int poll_funcs_state_destructor(struct poll_funcs_state *state) > for (i=0; i<num_timeouts; i++) { > TALLOC_FREE(state->timeouts[i]); > } >+ for (i=0; i<num_contexts; i++) { >+ TALLOC_FREE(state->contexts[i]); >+ } > return 0; > } > >-- >2.7.4 > > >From 53254ec922db99e1433e7c581ab42f08615e8db8 Mon Sep 17 00:00:00 2001 >From: Ralph Boehme <slow@samba.org> >Date: Thu, 15 Sep 2016 14:19:51 +0200 >Subject: [PATCH 3/4] s4/messaging: let the imessaging ctx destructor free > msg_dgm_ref > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272 > >Signed-off-by: Ralph Boehme <slow@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> >--- > source4/lib/messaging/messaging.c | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/source4/lib/messaging/messaging.c b/source4/lib/messaging/messaging.c >index ea50627..d0beef6 100644 >--- a/source4/lib/messaging/messaging.c >+++ b/source4/lib/messaging/messaging.c >@@ -304,6 +304,7 @@ static struct imessaging_context *msg_ctxs; > static int imessaging_context_destructor(struct imessaging_context *msg) > { > DLIST_REMOVE(msg_ctxs, msg); >+ TALLOC_FREE(msg->msg_dgm_ref); > return 0; > } > >-- >2.7.4 > > >From a3d33320ea3ee273b0a811bb1dd26908411288b5 Mon Sep 17 00:00:00 2001 >From: Jeremy Allison <jra@samba.org> >Date: Fri, 16 Sep 2016 23:37:20 -0700 >Subject: [PATCH 4/4] lib: poll_funcs : poll_funcs_context_slot_find can select the wrong slot to replace. > >Look for an exact match first, before a free slot. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272 > >Signed-off-by: Jeremy Allison <jra@samba.org> >--- > lib/poll_funcs/poll_funcs_tevent.c | 13 ++++++++++++- > 1 file changed, 12 insertions(+), 1 deletion(-) > >diff --git a/lib/poll_funcs/poll_funcs_tevent.c b/lib/poll_funcs/poll_funcs_tevent.c >index 233e911..4dd09a2 100644 >--- a/lib/poll_funcs/poll_funcs_tevent.c >+++ b/lib/poll_funcs/poll_funcs_tevent.c >@@ -504,10 +504,21 @@ static bool poll_funcs_context_slot_find(struct poll_funcs_state *state, > size_t num_contexts = talloc_array_length(state->contexts); > size_t i; > >+ /* Look for an existing match first. */ > for (i=0; i<num_contexts; i++) { > struct poll_funcs_tevent_context *ctx = state->contexts[i]; > >- if ((ctx == NULL) || (ctx->ev == ev)) { >+ if (ctx != NULL && ctx->ev == ev) { >+ *slot = i; >+ return true; >+ } >+ } >+ >+ /* Now look for a free slot. */ >+ for (i=0; i<num_contexts; i++) { >+ struct poll_funcs_tevent_context *ctx = state->contexts[i]; >+ >+ if (ctx == NULL) { > *slot = i; > return true; > } >-- >2.7.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
slow
:
review+
Actions:
View
Attachments on
bug 12272
: 12477 |
12492
|
12493