s4-resolve: fixed a crash bug on timeout

We were creating the name resolution context as a child of lp_ctx,
which meant when we gave up on a connection the timer on name
resolution kept running, and when it timed out the callback crashed as
the socket was already removed.

4 files changed, 8 insertions, 6 deletions

diff --git a/source4/libcli/finddcs.c b/source4/libcli/finddcs.c
index 2e4fad9332..8330042ea1 100644
--- a/source4/libcli/finddcs.c
+++ b/source4/libcli/finddcs.c
@@ -102,7 +102,7 @@ struct composite_context *finddcs_send(TALLOC_CTX *mem_ctx,
 	state->msg_ctx = msg_ctx;
 
 	make_nbt_name(&name, state->domain_name, name_type);
-	creq = resolve_name_send(resolve_ctx, &name, event_ctx);
+	creq = resolve_name_send(resolve_ctx, state, &name, event_ctx);
 	composite_continue(c, creq, finddcs_name_resolved, state);
 	return c;
 }
diff --git a/source4/libcli/resolve/resolve.c b/source4/libcli/resolve/resolve.c
index 6a3d5daecc..0ad3a75e89 100644
--- a/source4/libcli/resolve/resolve.c
+++ b/source4/libcli/resolve/resolve.c
@@ -136,6 +136,7 @@ static struct composite_context *setup_next_method(struct composite_context *c)
   general name resolution - async send
  */
 struct composite_context *resolve_name_all_send(struct resolve_context *ctx,
+						TALLOC_CTX *mem_ctx,
 						uint32_t flags,
 						uint16_t port,
 						struct nbt_name *name,
@@ -148,7 +149,7 @@ struct composite_context *resolve_name_all_send(struct resolve_context *ctx,
 		return NULL;
 	}
 
-	c = composite_create(ctx, event_ctx);
+	c = composite_create(mem_ctx, event_ctx);
 	if (c == NULL) return NULL;
 
 	if (composite_nomem(c->event_ctx, c)) return c;
@@ -221,10 +222,11 @@ NTSTATUS resolve_name_all_recv(struct composite_context *c,
 }
 
 struct composite_context *resolve_name_send(struct resolve_context *ctx,
+					    TALLOC_CTX *mem_ctx,
 					    struct nbt_name *name,
 					    struct tevent_context *event_ctx)
 {
-	return resolve_name_all_send(ctx, 0, 0, name, event_ctx);
+	return resolve_name_all_send(ctx, mem_ctx, 0, 0, name, event_ctx);
 }
 
 NTSTATUS resolve_name_recv(struct composite_context *c,
@@ -253,7 +255,7 @@ NTSTATUS resolve_name(struct resolve_context *ctx,
 			  const char **reply_addr,
 			  struct tevent_context *ev)
 {
-	struct composite_context *c = resolve_name_send(ctx, name, ev);
+	struct composite_context *c = resolve_name_send(ctx, mem_ctx, name, ev);
 	return resolve_name_recv(c, mem_ctx, reply_addr);
 }
 
diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
index 8c1a73b681..64ed6c3acc 100644
--- a/source4/libcli/smb2/connect.c
+++ b/source4/libcli/smb2/connect.c
@@ -271,7 +271,7 @@ struct composite_context *smb2_connect_send(TALLOC_CTX *mem_ctx,
 	ZERO_STRUCT(name);
 	name.name = host;
 
-	creq = resolve_name_send(resolve_ctx, &name, c->event_ctx);
+	creq = resolve_name_send(resolve_ctx, state, &name, c->event_ctx);
 	composite_continue(c, creq, continue_resolve, c);
 	return c;
 }
diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c
index 9a19771bc0..3d35018acb 100644
--- a/source4/libcli/smb_composite/connect.c
+++ b/source4/libcli/smb_composite/connect.c
@@ -480,7 +480,7 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec
 
 	state->stage = CONNECT_RESOLVE;
 	make_nbt_name_server(&name, io->in.dest_host);
-	state->creq = resolve_name_send(resolve_ctx, &name, c->event_ctx);
+	state->creq = resolve_name_send(resolve_ctx, state, &name, c->event_ctx);
 
 	if (state->creq == NULL) goto failed;
 	state->creq->async.private_data = c;