From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 27 Sep 2010 21:57:34 +0000 (+0200)
Subject: tsocket: make sure we delete the fd event before calling close()
X-Git-Tag: samba-4.0.0alpha14~2336
X-Git-Url: http://git.samba.org/samba.git/?p=samba.git;a=commitdiff_plain;h=4423aa59abda50c8b71815f922ea03e2009f9e50

tsocket: make sure we delete the fd event before calling close()

We got random double free errors, when getting events from
epoll_wait() and try to dereference the private talloc pointer
attached to it.

Before doing the close() in the tstream_disconnect_send() function
we need to delete the fd event.

commit 38f505530ba06323a56c7d3914630efffcd12629 only fixed it for
tdgram sockets.

metze
---

diff --git a/lib/tsocket/tsocket_bsd.c b/lib/tsocket/tsocket_bsd.c
index 6fb1535ea0d..bc7cfe3fe9e 100644
--- a/lib/tsocket/tsocket_bsd.c
+++ b/lib/tsocket/tsocket_bsd.c
@@ -1895,6 +1895,7 @@ static struct tevent_req *tstream_bsd_disconnect_send(TALLOC_CTX *mem_ctx,
 		goto post;
 	}
 
+	TALLOC_FREE(bsds->fde);
 	ret = close(bsds->fd);
 	bsds->fd = -1;
 	err = tsocket_bsd_error_from_errno(ret, errno, &dummy);