From 2c53c2a3bc3c94d3c8a7931b21a743224d4ab6ca Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Mon, 19 Sep 2016 11:42:05 -0700
Subject: [PATCH 1/2] lib/poll_funcs: free contexts in
 poll_funcs_state_destructor()

This ensures the destructors get called in the proper order.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272

Back-port from c132b78c484c14d255a98567e90b934b73ebf8c2

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---
 source3/lib/poll_funcs/poll_funcs_tevent.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/source3/lib/poll_funcs/poll_funcs_tevent.c b/source3/lib/poll_funcs/poll_funcs_tevent.c
index 8fdf080..6052077 100644
--- a/source3/lib/poll_funcs/poll_funcs_tevent.c
+++ b/source3/lib/poll_funcs/poll_funcs_tevent.c
@@ -302,6 +302,9 @@ static int poll_funcs_state_destructor(struct poll_funcs_state *state)
 	for (i=0; i<state->num_watches; i++) {
 		TALLOC_FREE(state->watches[i]);
 	}
+	for (i=0; i<state->num_contexts; i++) {
+		TALLOC_FREE(state->contexts[i]);
+	}
 	return 0;
 }
 
-- 
2.7.4


From 6477dad083aff69d274a36ae19c0130e2d9c6fc9 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Mon, 19 Sep 2016 11:47:22 -0700
Subject: [PATCH 2/2] lib: poll_funcs : poll_funcs_context_slot_find can select
 the wrong slot to replace.

Look for an exact match first, before a free slot.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272

Back-port from 085542fc93b3c603e8cda6e481e94d5fe2dfc669

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---
 source3/lib/poll_funcs/poll_funcs_tevent.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/source3/lib/poll_funcs/poll_funcs_tevent.c b/source3/lib/poll_funcs/poll_funcs_tevent.c
index 6052077..65adb2d 100644
--- a/source3/lib/poll_funcs/poll_funcs_tevent.c
+++ b/source3/lib/poll_funcs/poll_funcs_tevent.c
@@ -318,15 +318,27 @@ static bool poll_funcs_context_slot_find(struct poll_funcs_state *state,
 	struct poll_funcs_tevent_context **contexts;
 	unsigned i;
 
+	/* Look for an existing match first. */
 	for (i=0; i<state->num_contexts; i++) {
 		struct poll_funcs_tevent_context *ctx = state->contexts[i];
 
-		if ((ctx == NULL) || (ctx->ev == ev)) {
+		if (ctx != NULL && ctx->ev == ev) {
 			*slot = i;
 			return true;
 		}
 	}
 
+	/* Now look for a free slot. */
+	for (i=0; i<state->num_contexts; i++) {
+		struct poll_funcs_tevent_context *ctx = state->contexts[i];
+
+		if (ctx == NULL) {
+			*slot = i;
+			return true;
+		}
+	}
+
+
 	contexts = talloc_realloc(state, state->contexts,
 				  struct poll_funcs_tevent_context *,
 				  state->num_contexts + 1);
-- 
2.7.4