[SSSD] [PATCH] fix early free of sdap_handle
Eugene Indenbom
eindenbom at gmail.com
Wed Apr 14 07:53:36 UTC 2010
On 04/14/2010 11:13 AM, Sumit Bose wrote:
> On Wed, Apr 14, 2010 at 10:48:28AM +0400, Eugene Indenbom wrote:
> ...
>
>> 3. My patch contained an additional fix to sdap_handle_release.
>> Before calling op callbacks LDAP callback data was destroyed:
>>
>> commit: sssd-1_1_1
>> line 102: talloc_zfree(sh->conncb->lc_arg);
>>
>> and later LDAP handle was unbound:
>> line 116: ldap_unbind_ext(sh->ldap, NULL, NULL);
>>
>> But during unbind the LDAP callbacks are called. And sssd callback
>> (sdap_ldap_connect_callback_del) accesses zero pointer (lc_arg).
>>
>> So before freeing sh->conncb->lc_arg it is necessary to call:
>> /* remove callback first */
>> ldap_get_option(sh->ldap, LDAP_OPT_CONNECT_CB, sh->conncb);
>>
>> Actually I wonder how does it work for you without this fix?
>> Probably you have never tried to close a connection with still open
>> file descriptor.
>>
>>
> ...
>
> This is not necessary, because sdap_ldap_connect_callback_del() checks
> if lc_arg is NULL.
>
That's right, but I remember that during debugging of my patch I have
indeed run across a crash related to this early free.
Probably it was not in sdap_ldap_connect_callback_del, but rather in
sdap_ldap_connect_callback_add. Although I can not right now figure out
how to reproduce it.
It's anyway safer to remove callback first and then free the callback data.
Regards, Eugene
More information about the sssd-devel
mailing list