On Tue, 2011-12-13 at 16:01 +0100, Jakub Hrozek wrote:
https://fedorahosted.org/sssd/ticket/1090
Unfortunately there is not enough info in rhbz #754114 where the bug
originated, so just band-aid the crash for now.
Nack.
Looking at this closely, I think what probably happened is that the
child died while waiting for the ping_check to time out, so that when it
finally returned, the memory for the mt_svc object had been freed.
Because we then use talloc_get_type() to retrieve that memory, it
detects that it's invalid and simply returns NULL (which we then
dereference and crash on).
The real solution here would be to ensure that we cancel the
DBusPendingCall with dbus_pending_call_cancel() if the mt_svc is freed.
So we need to modify the mt_svc structure to contain a DBusPendingCall *
attribute that we assign to it when service_send_ping() calls
sbus_conn_send() (currently, we just pass NULL for the 'pending' return
to ignore it).
Then, we need to make sure that the mt_svc destructor will call
dbus_pending_call_cancel() on mt_svc->pending, which will prevent us
from reaching the ping_check() function.
(Obviously, we need to NULLify the mt_svc->pending attribute once we
reach the ping_check() function correctly).
There's certainly no reason we can't ALSO include the band-aid of this
patch, but I'd rather fix the underlying problem.