r1516: remove the server_connection from the list on the server_socket

and call talloc_destroy(srv_conn->mem_ctx)

also don't follow NULL pointers

metze
(This used to be commit 786c00c3d4f510c870a45f11af69281298ba176d)

diff --git a/source4/smbd/process_single.c b/source4/smbd/process_single.c
index 554f3e91daa47834d556a3b7d4921715f0b3c73f..8bd00c53b95e2c66bb494a82fe9881afbcd6f7d8 100644 (file)
--- a/source4/smbd/process_single.c
+++ b/source4/smbd/process_single.c
@@ -68,8 +68,18 @@ static void single_accept_connection(struct event_context *ev, struct fd_event *
 static void single_terminate_connection(struct server_connection *conn, const char *reason) 
 {
        DEBUG(0,("single_terminate_connection: reason[%s]\n",reason));
-       conn->service->ops->close_connection(conn,reason);
-       server_destroy_connection(conn);
+
+       if (conn) {
+               if (conn->service) {
+                       conn->service->ops->close_connection(conn,reason);
+               }
+
+               if (conn->server_socket) {
+                       DLIST_REMOVE(conn->server_socket->connection_list,conn);
+               }
+
+               server_destroy_connection(conn);
+       }
 }
 
 static int single_get_id(struct smbsrv_request *req)

diff --git a/source4/smbd/process_standard.c b/source4/smbd/process_standard.c
index 19306656b5d49618b4e3074e4568ef09c2b0059d..c12a1f4305edfd9b8d9f16853104a01466b5a533 100644 (file)
--- a/source4/smbd/process_standard.c
+++ b/source4/smbd/process_standard.c
@@ -91,8 +91,19 @@ static void standard_accept_connection(struct event_context *ev, struct fd_event
 static void standard_terminate_connection(struct server_connection *conn, const char *reason) 
 {
        DEBUG(0,("single_terminate_connection: reason[%s]\n",reason));
-       conn->service->ops->close_connection(conn,reason);
-       server_destroy_connection(conn);
+
+       if (conn) {
+               if (conn->service) {
+                       conn->service->ops->close_connection(conn,reason);
+               }
+
+               if (conn->server_socket) {
+                       DLIST_REMOVE(conn->server_socket->connection_list,conn);
+               }
+
+               server_destroy_connection(conn);
+       }
+
        /* terminate this process */
        exit(0);
 }

diff --git a/source4/smbd/process_thread.c b/source4/smbd/process_thread.c
index 687dafea04f25b7d7349e2b957ee4c2208a363be..ced07d5d76ce925f2e43c4c3b12402f0aa2ac409 100644 (file)
--- a/source4/smbd/process_thread.c
+++ b/source4/smbd/process_thread.c
@@ -108,8 +108,21 @@ static void thread_accept_connection(struct event_context *ev, struct fd_event *
 static void thread_terminate_connection(struct server_connection *conn, const char *reason) 
 {
        DEBUG(0,("thread_terminate_connection: reason[%s]\n",reason));
-       conn->service->ops->close_connection(conn,reason);
-       server_destroy_connection(conn);
+
+       if (conn) {
+               if (conn->service) {
+                       conn->service->ops->close_connection(conn,reason);
+               }
+
+               if (conn->server_socket) {
+                       MUTEX_LOCK_BY_ID(MUTEX_SMBD);
+                       DLIST_REMOVE(conn->server_socket->connection_list,conn);
+                       MUTEX_UNLOCK_BY_ID(MUTEX_SMBD);
+               }
+
+               server_destroy_connection(conn);
+       }
+
        /* terminate this thread */
        pthread_exit(NULL);  /* thread cleanup routine will do actual cleanup */
 }

diff --git a/source4/smbd/service.c b/source4/smbd/service.c
index d225a69b1758339971b2baa6c1cc365e46bba048..c90792e45259af4c3d6fa7ba7017875aa9932cf1 100644 (file)
--- a/source4/smbd/service.c
+++ b/source4/smbd/service.c
@@ -247,8 +247,11 @@ void server_terminate_connection(struct server_connection *srv_conn, const char
 void server_destroy_connection(struct server_connection *srv_conn)
 {
        close(srv_conn->event.fde->fd);
+
        event_remove_fd(srv_conn->event.ctx, srv_conn->event.fde);
        event_remove_timed(srv_conn->event.ctx, srv_conn->event.idle);
+
+       talloc_destroy(srv_conn->mem_ctx);
 }
 
 void server_io_handler(struct event_context *ev, struct fd_event *fde, time_t t, uint16_t flags)