On Tue, 2011-12-13 at 10:18 -0500, Stephen Gallagher wrote:
On Tue, 2011-12-13 at 16:01 +0100, Jakub Hrozek wrote:
>
https://fedorahosted.org/sssd/ticket/1090
>
> Unfortunately there is not enough info in rhbz #754114 where the bug
> originated, so just band-aid the crash for now.
Nack.
Looking at this closely, I think what probably happened is that the
child died while waiting for the ping_check to time out, so that when it
finally returned, the memory for the mt_svc object had been freed.
Because we then use talloc_get_type() to retrieve that memory, it
detects that it's invalid and simply returns NULL (which we then
dereference and crash on).
maybe we should use talloc_get_type_abort() here ...
The real solution here would be to ensure that we cancel the
DBusPendingCall with dbus_pending_call_cancel() if the mt_svc is freed.
So we need to modify the mt_svc structure to contain a DBusPendingCall *
attribute that we assign to it when service_send_ping() calls
sbus_conn_send() (currently, we just pass NULL for the 'pending' return
to ignore it).
Ack
Then, we need to make sure that the mt_svc destructor will call
dbus_pending_call_cancel() on mt_svc->pending, which will prevent us
from reaching the ping_check() function.
(Obviously, we need to NULLify the mt_svc->pending attribute once we
reach the ping_check() function correctly).
There's certainly no reason we can't ALSO include the band-aid of this
patch, but I'd rather fix the underlying problem.
Ack x 2
Simo.
--
Simo Sorce * Red Hat, Inc * New York