r1516: remove the server_connection from the list on the server_socket

and call talloc_destroy(srv_conn->mem_ctx)

also don't follow NULL pointers

metze
(This used to be commit 786c00c3d4f510c870a45f11af69281298ba176d)

4 files changed, 43 insertions, 6 deletions

diff --git a/source4/smbd/process_single.c b/source4/smbd/process_single.c
index 554f3e91da..8bd00c53b9 100644
--- a/source4/smbd/process_single.c
+++ b/source4/smbd/process_single.c
@@ -68,8 +68,18 @@ static void single_accept_connection(struct event_context *ev, struct fd_event *
 static void single_terminate_connection(struct server_connection *conn, const char *reason) 
 {
 	DEBUG(0,("single_terminate_connection: reason[%s]\n",reason));
-	conn->service->ops->close_connection(conn,reason);
-	server_destroy_connection(conn);
+
+	if (conn) {
+		if (conn->service) {
+			conn->service->ops->close_connection(conn,reason);
+		}
+
+		if (conn->server_socket) {
+			DLIST_REMOVE(conn->server_socket->connection_list,conn);
+		}
+
+		server_destroy_connection(conn);
+	}
 }
 
 static int single_get_id(struct smbsrv_request *req)
diff --git a/source4/smbd/process_standard.c b/source4/smbd/process_standard.c
index 19306656b5..c12a1f4305 100644
--- a/source4/smbd/process_standard.c
+++ b/source4/smbd/process_standard.c
@@ -91,8 +91,19 @@ static void standard_accept_connection(struct event_context *ev, struct fd_event
 static void standard_terminate_connection(struct server_connection *conn, const char *reason) 
 {
 	DEBUG(0,("single_terminate_connection: reason[%s]\n",reason));
-	conn->service->ops->close_connection(conn,reason);
-	server_destroy_connection(conn);
+
+	if (conn) {
+		if (conn->service) {
+			conn->service->ops->close_connection(conn,reason);
+		}
+
+		if (conn->server_socket) {
+			DLIST_REMOVE(conn->server_socket->connection_list,conn);
+		}
+
+		server_destroy_connection(conn);
+	}
+
 	/* terminate this process */
 	exit(0);
 }
diff --git a/source4/smbd/process_thread.c b/source4/smbd/process_thread.c
index 687dafea04..ced07d5d76 100644
--- a/source4/smbd/process_thread.c
+++ b/source4/smbd/process_thread.c
@@ -108,8 +108,21 @@ static void thread_accept_connection(struct event_context *ev, struct fd_event *
 static void thread_terminate_connection(struct server_connection *conn, const char *reason) 
 {
 	DEBUG(0,("thread_terminate_connection: reason[%s]\n",reason));
-	conn->service->ops->close_connection(conn,reason);
-	server_destroy_connection(conn);
+
+	if (conn) {
+		if (conn->service) {
+			conn->service->ops->close_connection(conn,reason);
+		}
+
+		if (conn->server_socket) {
+			MUTEX_LOCK_BY_ID(MUTEX_SMBD);
+			DLIST_REMOVE(conn->server_socket->connection_list,conn);
+			MUTEX_UNLOCK_BY_ID(MUTEX_SMBD);
+		}
+
+		server_destroy_connection(conn);
+	}
+
 	/* terminate this thread */
 	pthread_exit(NULL);  /* thread cleanup routine will do actual cleanup */
 }
diff --git a/source4/smbd/service.c b/source4/smbd/service.c
index d225a69b17..c90792e452 100644
--- a/source4/smbd/service.c
+++ b/source4/smbd/service.c
@@ -247,8 +247,11 @@ void server_terminate_connection(struct server_connection *srv_conn, const char
 void server_destroy_connection(struct server_connection *srv_conn)
 {
 	close(srv_conn->event.fde->fd);
+
 	event_remove_fd(srv_conn->event.ctx, srv_conn->event.fde);
 	event_remove_timed(srv_conn->event.ctx, srv_conn->event.idle);
+
+	talloc_destroy(srv_conn->mem_ctx);
 }
 
 void server_io_handler(struct event_context *ev, struct fd_event *fde, time_t t, uint16_t flags)