From 03c06568988c36776a54f9b701e74f284483555e Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 14 Nov 2013 21:30:49 +0100 Subject: [PATCH] smbd: Fix a talloc hierarchy problem in msg_channel When tearing down a watch_send with an open tevent_immediate, we talloc_free the msg_channel while the tevent_immediate still references it. Don't make the tevent_immediate outlive the msg_channel. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10250 Signed-off-by: Volker Lendecke Reviewed-by: Jeremy Allison Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Wed Nov 20 00:13:51 CET 2013 on sn-devel-104 (cherry picked from commit 2d91577f984bc83c2c87141cfdda87d068060b32) --- source3/lib/msg_channel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/lib/msg_channel.c b/source3/lib/msg_channel.c index c68c11e..1a30472 100644 --- a/source3/lib/msg_channel.c +++ b/source3/lib/msg_channel.c @@ -244,7 +244,7 @@ struct tevent_req *msg_read_send(TALLOC_CTX *mem_ctx, num_msgs = talloc_array_length(channel->msgs); if (num_msgs != 0) { - im = tevent_create_immediate(channel->ev); + im = tevent_create_immediate(channel); if (tevent_req_nomem(im, req)) { return tevent_req_post(req, ev); } -- 1.7.9.5