r10699: fixed the dcerpc code so that you can shutdown the pipe safely from

within a callback on the pipe. This should fix a problem volker
encountered with winbind. The fix invoolves making the recv_data
handler free the memory for a packet, instead of having the transport
layer free it after calling recv_data. When the transport layer freed
it, it had no way of knowing if the callback had shutdown the pipe, so
it had no way of knowing if it could safely use the pointer.

Also changed the pipe shutdown hook for the smb transport to use an
async SMB close. This ensures that when you shutdown the pipe, you
don't block waiting for the server to ack the close of the pipe fnum.
(This used to be commit c87d7f580e39245db181605f50883de07dd9632e)

1 files changed, 4 insertions, 2 deletions

diff --git a/source4/librpc/rpc/dcerpc_sock.c b/source4/librpc/rpc/dcerpc_sock.c
index d7f87e9706..161c9a56dc 100644
--- a/source4/librpc/rpc/dcerpc_sock.c
+++ b/source4/librpc/rpc/dcerpc_sock.c
@@ -120,6 +120,7 @@ static void sock_process_recv(struct dcerpc_connection *p)
 	struct sock_private *sock = p->transport.private;
 	NTSTATUS status;
 	size_t nread;
+	DATA_BLOB data;
 
 	if (sock->recv.data.data == NULL) {
 		sock->recv.data = data_blob_talloc(sock, NULL, MIN_HDR_SIZE);
@@ -176,14 +177,15 @@ static void sock_process_recv(struct dcerpc_connection *p)
 	}
 
 	/* we have a full packet */
-	p->transport.recv_data(p, &sock->recv.data, NT_STATUS_OK);
-	talloc_free(sock->recv.data.data);
+	data = sock->recv.data;
 	sock->recv.data = data_blob(NULL, 0);
 	sock->recv.received = 0;
 	sock->recv.pending_count--;
 	if (sock->recv.pending_count == 0) {
 		EVENT_FD_NOT_READABLE(sock->fde);
 	}
+
+	p->transport.recv_data(p, &data, NT_STATUS_OK);
 }
 
 /*