On (02/12/13 19:41), Pavel Reichl wrote:
Hello,
first four patches address issues of freeing mt_svc structure. Last one
adds warns to syslog.
Pavel Reichl
From 1d44284275e9f227d2f39085c6a6661a04e9b69c Mon Sep 17 00:00:00
2001
From: Pavel Reichl <pavel.reichl(a)redhat.com>
Date: Mon, 2 Dec 2013 14:51:59 +0000
Subject: [PATCH 1/5] monitor: use-after-free bugfix
*monitor_kill_service* may create timed event which operates on *svc* and
therefore *svc* should not be freed right after call of *monitor_kill_sercice*.
*svc* is supposed to be freed by *mt_svc_restart*.
---
src/monitor/monitor.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index 92bac422a53b450f29a2d5b23217b530030781c2..ce4b1adb12626517d5cfa0a932fb6c6198cd2858
100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -727,7 +727,6 @@ static int service_signal(struct mt_svc *svc, const char *svc_signal)
if (!msg) {
DEBUG(0,("Out of memory?!\n"));
monitor_kill_service(svc);
- talloc_free(svc);
Could you tell me where will be this service freed?
neither monitor_kill_service nor mt_svc_sigkill will free it
(except special cases). Services are allocated under long-living monitor
context. But I agree that it should not be freed if timer is created.
From 60033e161524a27587d409ae8f4807a9d70c8d02 Mon Sep 17 00:00:00
2001
From: Pavel Reichl <pavel.reichl(a)redhat.com>
Date: Mon, 2 Dec 2013 15:20:01 +0000
Subject: [PATCH 2/5] monitor: use-after-free bugfix
Why do you split use-after-free bug fixes into two patches?
Is there any special reason?
Someone else should also look at the patches, because it is main part of
sssd :-)
LS