From c809f99c3ef2392ab5f6f21213ad3164ab6727f7 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 14 Nov 2013 21:30:49 +0100 Subject: [PATCH] smbd: Fix a talloc hierarchy problem in msg_channel When tearing down a watch_send with an open tevent_immediate, we talloc_free the msg_channel while the tevent_immediate still references it. Don't make the tevent_immediate outlive the msg_channel. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10250 Signed-off-by: Volker Lendecke --- source3/lib/msg_channel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/lib/msg_channel.c b/source3/lib/msg_channel.c index 537b162..625d07c 100644 --- a/source3/lib/msg_channel.c +++ b/source3/lib/msg_channel.c @@ -244,7 +244,7 @@ struct tevent_req *msg_read_send(TALLOC_CTX *mem_ctx, num_msgs = talloc_array_length(channel->msgs); if (num_msgs != 0) { - im = tevent_create_immediate(channel->ev); + im = tevent_create_immediate(channel); if (tevent_req_nomem(im, req)) { return tevent_req_post(req, ev); } -- 1.7.9.5