s4:torture: Fix segfault in multichannel test

The timer for the timeout_cb() handler was created on a memory context
which doesn't get freed, so the timer was still valid when running
the next test and fired there. It was then writing into random memory
leading to segfaults.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Dec  1 15:03:19 UTC 2022 on sn-devel-184

diff --git a/source4/torture/smb2/multichannel.c b/source4/torture/smb2/multichannel.c
index 24c736d6701a25085ed4bdc31537b261d1f47f1c..0c0bc5d1a7e2ce5f4b5977b521ccc2b98fc280df 100644 (file)
--- a/source4/torture/smb2/multichannel.c
+++ b/source4/torture/smb2/multichannel.c
@@ -1862,7 +1862,6 @@ static bool test_multichannel_lease_break_test3(struct torture_context *tctx,
        struct tevent_timer *te = NULL;
        struct timeval ne;
        bool timesup = false;
-       TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 
        if (!test_multichannel_initial_checks(tctx, tree1)) {
                return true;
@@ -1914,7 +1913,7 @@ static bool test_multichannel_lease_break_test3(struct torture_context *tctx,
 
        /* Set a timeout for 5 seconds for session 1 to open file1 */
        ne = tevent_timeval_current_ofs(0, 5000000);
-       te = tevent_add_timer(tctx->ev, tmp_ctx, ne, timeout_cb, &timesup);
+       te = tevent_add_timer(tctx->ev, mem_ctx, ne, timeout_cb, &timesup);
        if (te == NULL) {
                torture_comment(tctx, "Failed to add timer.");
                goto done;