ctdb-recovery-helper: Deregister message handler in error paths
authorAmitay Isaacs <amitay@gmail.com>
Wed, 13 Dec 2017 05:12:09 +0000 (16:12 +1100)
committerMartin Schwenke <martins@samba.org>
Wed, 13 Dec 2017 07:48:18 +0000 (08:48 +0100)
commitde3f0d889b3667eb165ab1004fdfff3a05046110
tree40013b8b34e74db3d10c74730186b83a3b20909a
parentcb5e6e8c798b19610dfaa505fdfc5b2cab3fa19b
ctdb-recovery-helper: Deregister message handler in error paths

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13188

If PULL_DB control times out but the remote node is still sending the
data, then the tevent_req for pull_database_send will be freed without
removing the message handler.  So when the data is received, srvid
handler will be called and it will try to access tevent_req which will
result in use-after-free and abort.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
ctdb/server/ctdb_recovery_helper.c