From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 1 Oct 2019 13:43:40 +0000 (-0400)
Subject: check child state_ctx against parent
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ddf1361a8653b50a425ce72a37dfeade589d05f5;p=thirdparty%2Ffreeradius-server.git

check child state_ctx against parent

The EAP code should arguably call request_detach() or something,
but this is a quick and easy fix
---

diff --git a/src/lib/server/request.c b/src/lib/server/request.c
index 2c2f0fe661c..bfec99e17a9 100644
--- a/src/lib/server/request.c
+++ b/src/lib/server/request.c
@@ -50,8 +50,24 @@ static int _request_free(REQUEST *request)
 	 *	need to persist across requests, they will already have been
 	 *	moved to a fr_state_entry_t, with the state pointers in the
 	 *	request being set to NULL, before the request is freed.
+	 *
+	 *	Our state ctx can be the same as the parents if
+	 *	request_data_restore_to_child() was called.  That
+	 *	function resets the childs state_ctx to be the same as
+	 *	the parents.  Adding this check here means that we
+	 *	don't need to call request_detach() on a child which
+	 *	will be freed immediately after the detach.
+	 *
+	 *	Note also that we do NOT call TALLOC_FREE(), which
+	 *	sets state_ctx=NULL.  We don't control the order in
+	 *	which talloc frees the children.  And the parents
+	 *	state_ctx pointer needs to stick around so that all of
+	 *	the children can check it.
 	 */
-	if (request->state_ctx) TALLOC_FREE(request->state_ctx);
+	if (request->state_ctx &&
+	    (!request->parent || (request->parent->state_ctx != request->state_ctx))) {
+		talloc_free(request->state_ctx);
+	}
 
 	talloc_free_children(request);