Fix winbindd crash in an unusual failure mode. Bug #5737. Based on original patch...

Jeremy.

diff --git a/source/winbindd/winbindd_dual.c b/source/winbindd/winbindd_dual.c
index f3b277cc84e26270f6bbd4c9e60cdd523df92229..9e9a244acfb35281ed4ab41c7e25e7a62757e268 100644 (file)
--- a/source/winbindd/winbindd_dual.c
+++ b/source/winbindd/winbindd_dual.c
@@ -196,10 +196,12 @@ static void async_request_fail(struct winbindd_async_request *state)
 
        TALLOC_FREE(state->reply_timeout_event);
 
-       SMB_ASSERT(state->child_pid != (pid_t)0);
+       /* If child exists and is not already reaped,
+          send kill signal to child. */
 
-       /* If not already reaped, send kill signal to child. */
-       if (state->child->pid == state->child_pid) {
+       if ((state->child->pid != (pid_t)0) &&
+                       (state->child->pid != (pid_t)-1) &&
+                       (state->child->pid == state->child_pid)) {
                kill(state->child_pid, SIGTERM);
 
                /* 
@@ -295,12 +297,14 @@ static void schedule_async_request(struct winbindd_child *child)
        }
 
        if ((child->pid == 0) && (!fork_domain_child(child))) {
-               /* Cancel all outstanding requests */
+               /* fork_domain_child failed.
+                  Cancel all outstanding requests */
 
                while (request != NULL) {
                        /* request might be free'd in the continuation */
                        struct winbindd_async_request *next = request->next;
-                       request->continuation(request->private_data, False);
+
+                       async_request_fail(request);
                        request = next;
                }
                return;