r17087: - make pvfs_notify_next_send static

- fix double free:
  a talloc_reference(a,b) when a is a child of b
  doesn't prevent talloc_free(b) from destroiying a and b.

metze
(This used to be commit 41acbc6645cc22d7f5f061dc5eda9b938ca018ba)

1 files changed, 2 insertions, 4 deletions

diff --git a/source4/ntvfs/posix/pvfs_notify.c b/source4/ntvfs/posix/pvfs_notify.c
index ffbe1f8bb7..d6fec02305 100644
--- a/source4/ntvfs/posix/pvfs_notify.c
+++ b/source4/ntvfs/posix/pvfs_notify.c
@@ -47,11 +47,10 @@ struct pvfs_notify_buffer {
 /*
   send a notify on the next event run. 
 */
-void pvfs_notify_send_next(struct event_context *ev, struct timed_event *te, 
-			   struct timeval t, void *ptr)
+static void pvfs_notify_send_next(struct event_context *ev, struct timed_event *te, 
+				  struct timeval t, void *ptr)
 {
 	struct ntvfs_request *req = talloc_get_type(ptr, struct ntvfs_request);
-	talloc_free(req);
 	req->async_states->send_fn(req);
 }
 
@@ -109,7 +108,6 @@ static void pvfs_notify_send(struct pvfs_notify_buffer *notify_buffer,
 	/* we can't call pvfs_notify_send() directly here, as that
 	   would free the request, and the ntvfs modules above us
 	   could use it, so call it on the next event */
-	talloc_reference(notify_buffer, req);
 	event_add_timed(req->ctx->event_ctx, 
 			req, timeval_zero(), pvfs_notify_send_next, req);
 }