Fix winbindd crash in an unusual failure mode. Bug #5737. Based on original patch from shargagan@novell.com

Jeremy.

1 files changed, 9 insertions, 5 deletions

diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c
index 63ce0e8d7f..1600f05eb1 100644
--- a/source3/winbindd/winbindd_dual.c
+++ b/source3/winbindd/winbindd_dual.c
@@ -196,10 +196,12 @@ static void async_request_fail(struct winbindd_async_request *state)
 
 	TALLOC_FREE(state->reply_timeout_event);
 
-	SMB_ASSERT(state->child_pid != (pid_t)0);
+	/* If child exists and is not already reaped,
+	   send kill signal to child. */
 
-	/* If not already reaped, send kill signal to child. */
-	if (state->child->pid == state->child_pid) {
+	if ((state->child->pid != (pid_t)0) &&
+			(state->child->pid != (pid_t)-1) &&
+			(state->child->pid == state->child_pid)) {
 		kill(state->child_pid, SIGTERM);
 
 		/* 
@@ -295,12 +297,14 @@ static void schedule_async_request(struct winbindd_child *child)
 	}
 
 	if ((child->pid == 0) && (!fork_domain_child(child))) {
-		/* Cancel all outstanding requests */
+		/* fork_domain_child failed.
+		   Cancel all outstanding requests */
 
 		while (request != NULL) {
 			/* request might be free'd in the continuation */
 			struct winbindd_async_request *next = request->next;
-			request->continuation(request->private_data, False);
+
+			async_request_fail(request);
 			request = next;
 		}
 		return;