smbd: Fix a talloc hierarchy problem in msg_channel

When tearing down a watch_send with an open tevent_immediate, we
talloc_free the msg_channel while the tevent_immediate still references
it. Don't make the tevent_immediate outlive the msg_channel.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10250
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Nov 20 00:13:51 CET 2013 on sn-devel-104
(cherry picked from commit 2d91577f984bc83c2c87141cfdda87d068060b32)

diff --git a/source3/lib/msg_channel.c b/source3/lib/msg_channel.c
index c68c11ec2f0c8210895dc511ebc17e418728993b..1a304728b73bd01dd6ab19c6faa485cf0cdefb95 100644 (file)
--- a/source3/lib/msg_channel.c
+++ b/source3/lib/msg_channel.c
@@ -244,7 +244,7 @@ struct tevent_req *msg_read_send(TALLOC_CTX *mem_ctx,
 
        num_msgs = talloc_array_length(channel->msgs);
        if (num_msgs != 0) {
-               im = tevent_create_immediate(channel->ev);
+               im = tevent_create_immediate(channel);
                if (tevent_req_nomem(im, req)) {
                        return tevent_req_post(req, ev);
                }