From: Volker Lendecke <vl@samba.org>
Date: Tue, 30 Mar 2021 15:18:10 +0000 (+0200)
Subject: lib: Fix rundown of jobs sent with background_job_send()
X-Git-Tag: tevent-0.11.0~1331
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cabd67d69f7fa24a132b6e7850b9678aac269ec5;p=thirdparty%2Fsamba.git

lib: Fix rundown of jobs sent with background_job_send()

When using this with a trigger message in smbd it will crash at
rundown in messaging_deregister because the global messaging context
can be TALLOC_FREE'ed before the background job is freed.

Using messaging_filtered_send already takes care of this situation
properly.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/source3/lib/background.c b/source3/lib/background.c
index 3c8eb5897cd..74f7496d4f6 100644
--- a/source3/lib/background.c
+++ b/source3/lib/background.c
@@ -40,9 +40,8 @@ struct background_job_state {
 static int background_job_state_destructor(struct background_job_state *s);
 static void background_job_waited(struct tevent_req *subreq);
 static void background_job_done(struct tevent_req *subreq);
-static void background_job_trigger(
-	struct messaging_context *msg, void *private_data, uint32_t msg_type,
-	struct server_id server_id, DATA_BLOB *data);
+static bool background_job_trigger(
+	struct messaging_rec *rec, void *private_data);
 
 struct tevent_req *background_job_send(TALLOC_CTX *mem_ctx,
 				       struct tevent_context *ev,
@@ -83,10 +82,9 @@ struct tevent_req *background_job_send(TALLOC_CTX *mem_ctx,
 	talloc_set_destructor(state, background_job_state_destructor);
 
 	for (i=0; i<num_trigger_msgs; i++) {
-		NTSTATUS status;
-		status = messaging_register(msg, state, trigger_msgs[i],
-					    background_job_trigger);
-		if (tevent_req_nterror(req, status)) {
+		subreq = messaging_filtered_read_send(
+			state, ev, msg, background_job_trigger, state);
+		if (tevent_req_nomem(subreq, req)) {
 			return tevent_req_post(req, ev);
 		}
 	}
@@ -103,36 +101,38 @@ struct tevent_req *background_job_send(TALLOC_CTX *mem_ctx,
 
 static int background_job_state_destructor(struct background_job_state *state)
 {
-	size_t i;
-
 	TALLOC_FREE(state->pipe_req);
 	if (state->pipe_fd != -1) {
 		close(state->pipe_fd);
 		state->pipe_fd = -1;
 	}
 
-	for (i=0; i<state->num_trigger_msgs; i++) {
-		messaging_deregister(state->msg, state->trigger_msgs[i],
-				     state);
-	}
-
 	return 0;
 }
 
-static void background_job_trigger(
-	struct messaging_context *msg, void *private_data, uint32_t msg_type,
-	struct server_id server_id, DATA_BLOB *data)
+static bool background_job_trigger(
+	struct messaging_rec *rec, void *private_data)
 {
 	struct background_job_state *state = talloc_get_type_abort(
 		private_data, struct background_job_state);
+	size_t i;
 
 	if (state->wakeup_req == NULL) {
-		return;
+		return false;
+	}
+	for (i=0; i<state->num_trigger_msgs; i++) {
+		if (rec->msg_type == state->trigger_msgs[i]) {
+			break;
+		}
+	}
+	if (i == state->num_trigger_msgs) {
+		return false;
 	}
 	if (!tevent_req_set_endtime(state->wakeup_req, state->ev,
 				    timeval_zero())) {
 		DEBUG(10, ("tevent_req_set_endtime failed\n"));
 	}
+	return false;
 }
 
 static void background_job_waited(struct tevent_req *subreq)