From b1958f04e1a4e387277103642982c3fb07e6534c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Tue, 27 Aug 2013 11:11:05 +0200
Subject: [PATCH] SIGCHLD handler: do not call callback when pvt data where
 freed

https://fedorahosted.org/sssd/ticket/1992
---
 src/providers/child_common.c            | 24 +++++++++++++++++++++++-
 src/providers/child_common.h            |  8 +++++++-
 src/providers/ipa/ipa_dyndns.c          | 11 ++++++++++-
 src/providers/krb5/krb5_child_handler.c |  2 +-
 src/providers/ldap/sdap_child_helpers.c |  2 +-
 5 files changed, 42 insertions(+), 5 deletions(-)

diff --git a/src/providers/child_common.c b/src/providers/child_common.c
index 1cead3893ff24e06f37e5df5447fdca384f688ed..d1e84a97d1be75a7242363faa816ba6201aa82b8 100644
--- a/src/providers/child_common.c
+++ b/src/providers/child_common.c
@@ -252,7 +252,8 @@ struct sss_child_ctx_old {
 };
 
 int child_handler_setup(struct tevent_context *ev, int pid,
-                        sss_child_callback_t cb, void *pvt)
+                        sss_child_callback_t cb, void *pvt,
+                        struct sss_child_ctx_old **_child_ctx)
 {
     struct sss_child_ctx_old *child_ctx;
 
@@ -276,9 +277,30 @@ int child_handler_setup(struct tevent_context *ev, int pid,
     child_ctx->pvt = pvt;
 
     DEBUG(8, ("Signal handler set up for pid [%d]\n", pid));
+
+    if (_child_ctx != NULL) {
+        *_child_ctx = child_ctx;
+    }
+
     return EOK;
 }
 
+void child_handler_destroy(struct sss_child_ctx_old *ctx)
+{
+    errno_t ret;
+
+    /* We still want to wait for the child to finish, but the caller is not
+     * interested in the result anymore (e.g. timeout was reached). */
+    ctx->cb = NULL;
+    ctx->pvt = NULL;
+
+    ret = kill(ctx->pid, SIGKILL);
+    if (ret == -1) {
+        ret = errno;
+        DEBUG(SSSDBG_MINOR_FAILURE, ("kill failed [%d][%s].\n", ret, strerror(ret)));
+    }
+}
+
 /* Async communication with the child process via a pipe */
 
 struct write_pipe_state {
diff --git a/src/providers/child_common.h b/src/providers/child_common.h
index 1e9f1b6c152686ba75d5207ba48f0f131a4a2fff..999f287d9fe66495927343c1cc4aeabba4ea90d4 100644
--- a/src/providers/child_common.h
+++ b/src/providers/child_common.h
@@ -78,9 +78,15 @@ typedef void (*sss_child_callback_t)(int child_status,
                                      struct tevent_signal *sige,
                                      void *pvt);
 
+struct sss_child_ctx_old;
+
 /* Set up child termination signal handler */
 int child_handler_setup(struct tevent_context *ev, int pid,
-                        sss_child_callback_t cb, void *pvt);
+                        sss_child_callback_t cb, void *pvt,
+                        struct sss_child_ctx_old **_child_ctx);
+
+/* Destroy child termination signal handler */
+void child_handler_destroy(struct sss_child_ctx_old *ctx);
 
 /* Async communication with the child process via a pipe */
 struct tevent_req *write_pipe_send(TALLOC_CTX *mem_ctx,
diff --git a/src/providers/ipa/ipa_dyndns.c b/src/providers/ipa/ipa_dyndns.c
index 561ee5280612e8bde7b0eac3e484fd0ca68a23bf..a43901b6cea9155565a145b55deb86044d5f550c 100644
--- a/src/providers/ipa/ipa_dyndns.c
+++ b/src/providers/ipa/ipa_dyndns.c
@@ -356,6 +356,7 @@ failed:
 
 struct nsupdate_send_ctx {
     struct ipa_nsupdate_ctx *nsupdate_ctx;
+    struct sss_child_ctx_old *child_ctx;
     int child_status;
 };
 
@@ -588,7 +589,8 @@ fork_nsupdate_send(struct ipa_nsupdate_ctx *ctx)
 
         /* Set up SIGCHLD handler */
         ret = child_handler_setup(ctx->dyndns_ctx->ipa_ctx->id_ctx->be->ev,
-                                  pid, ipa_dyndns_child_handler, req);
+                                  pid, ipa_dyndns_child_handler, req,
+                                  &state->child_ctx);
         if (ret != EOK) {
             return NULL;
         }
@@ -618,9 +620,16 @@ static void ipa_dyndns_timeout(struct tevent_context *ev,
 {
     struct tevent_req *req =
             talloc_get_type(pvt, struct tevent_req);
+    struct nsupdate_send_ctx *state =
+            tevent_req_data(req, struct nsupdate_send_ctx);
+
 
     DEBUG(1, ("Timeout reached for dynamic DNS update\n"));
 
+    child_handler_destroy(state->child_ctx);
+    state->child_ctx = NULL;
+    state->child_status = ETIMEDOUT;
+
     tevent_req_error(req, ETIMEDOUT);
 }
 
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index bafa0bbf27cfc04fb59941d855d078819845c36d..dba2dec9a0578a80f71099607799444a1b2090d1 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -265,7 +265,7 @@ static errno_t fork_child(struct tevent_req *req)
         fd_nonblocking(state->io->read_from_child_fd);
         fd_nonblocking(state->io->write_to_child_fd);
 
-        ret = child_handler_setup(state->ev, pid, NULL, NULL);
+        ret = child_handler_setup(state->ev, pid, NULL, NULL, NULL);
         if (ret != EOK) {
             DEBUG(1, ("Could not set up child signal handler\n"));
             return ret;
diff --git a/src/providers/ldap/sdap_child_helpers.c b/src/providers/ldap/sdap_child_helpers.c
index 5a15e661e3ca014e511dc5647dd199d9839100a8..1af71285f70b6d07156fdf604132962202612dd6 100644
--- a/src/providers/ldap/sdap_child_helpers.c
+++ b/src/providers/ldap/sdap_child_helpers.c
@@ -121,7 +121,7 @@ static errno_t sdap_fork_child(struct tevent_context *ev,
         fd_nonblocking(child->read_from_child_fd);
         fd_nonblocking(child->write_to_child_fd);
 
-        ret = child_handler_setup(ev, pid, NULL, NULL);
+        ret = child_handler_setup(ev, pid, NULL, NULL, NULL);
         if (ret != EOK) {
             return ret;
         }
-- 
1.7.11.7

