[SSSD] [PATCH] fix early free of sdap_handle

Simo Sorce ssorce at redhat.com
Thu Apr 15 13:35:30 UTC 2010


On Thu, 15 Apr 2010 09:14:37 -0400
Simo Sorce <ssorce at redhat.com> wrote:

> I know the sdap_handle destructor() will end up caling it (through
> sdap_handle_release(), but then why all the games with the final
> argument ? Why not simply attach a destructor to sdap_handle_data that
> prevents destruction until it is safe ?
> Akso given we can prevent releasing sdap_handle too early through the
> destructor, why not simply apply all this to sdap_handle directly w/o
> requireing another sub-structure ?

Ah btw, while thinking about how you handle release of sdap_handle_data
I think I found a case where you end up with some issues.

If you free sdap_handle while sdap_handle_data is locked
sdap_handle_release will be called with final = ture, and this means
sh->private is set to NULL.
If later on sdap_handle_release is called again shd will be NULL (shd =
sh->private) and sdap_handle_data_lock(shd); wiull derefernce a NULL
pointer causing a segfault.

I haven't checked if this can actually happen, but given the ways you
use locks here it looks like it might.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list