From 1ae34a532f3012bff78286c00259c70e8f80e5b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Fri, 19 Oct 2012 12:03:03 +0200
Subject: [PATCH 3/4] free request table as the first thing when deallocating
 rctx

Now when we changed responder contexts hierarchy, we do not need
to special case shutting down in dp request code.
---
 src/responder/common/responder.h        | 2 --
 src/responder/common/responder_common.c | 8 ++++----
 src/responder/common/responder_dp.c     | 8 --------
 3 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/src/responder/common/responder.h b/src/responder/common/responder.h
index 2903aac0011eceb35dd2d26249b855750d7a1d34..5bab0d3c3aee67ad9a094a7a001a3df218e7fa16 100644
--- a/src/responder/common/responder.h
+++ b/src/responder/common/responder.h
@@ -104,8 +104,6 @@ struct resp_ctx {
     char *default_domain;
 
     void *pvt_ctx;
-
-    bool shutting_down;
 };
 
 struct cli_ctx {
diff --git a/src/responder/common/responder_common.c b/src/responder/common/responder_common.c
index dfc2f0fe3d5ed3abb5d8a0c434f3a741dd627417..c1b8f84e04577b8beefb3f915b5c28cf28b9b381 100644
--- a/src/responder/common/responder_common.c
+++ b/src/responder/common/responder_common.c
@@ -720,10 +720,11 @@ static int sss_responder_ctx_destructor(void *ptr)
 {
     struct resp_ctx *rctx = talloc_get_type(ptr, struct resp_ctx);
 
-    /* mark that we are shutting down the responder, so it is propagated
-     * into underlying contexts that are freed right before rctx */
     DEBUG(SSSDBG_TRACE_FUNC, ("Responder is being shut down\n"));
-    rctx->shutting_down = true;
+
+    /* request table may call callback that access some rctx fields,
+     * make sure that request table is the first thing to deallocate */
+    talloc_zfree(rctx->dp_request_table);
 
     return 0;
 }
@@ -757,7 +758,6 @@ int sss_process_init(TALLOC_CTX *mem_ctx,
     rctx->sock_name = sss_pipe_name;
     rctx->priv_sock_name = sss_priv_pipe_name;
     rctx->confdb_service_path = confdb_service_path;
-    rctx->shutting_down = false;
 
     talloc_set_destructor((TALLOC_CTX*)rctx, sss_responder_ctx_destructor);
 
diff --git a/src/responder/common/responder_dp.c b/src/responder/common/responder_dp.c
index 34fc9f3499f9b9f9f182e2a5a3e90419c6a0cad3..ca9cb834de7a6c0c3ce89ecc8eb20f61fe6c0428 100644
--- a/src/responder/common/responder_dp.c
+++ b/src/responder/common/responder_dp.c
@@ -76,14 +76,6 @@ static int sss_dp_req_destructor(void *ptr)
         sdp_req->pending_reply = NULL;
     }
 
-    /* Do not call callbacks if the responder is shutting down, because
-     * the top level responder context (pam_ctx, sudo_ctx, ...) may be
-     * already semi-freed and we may end up accessing freed memory.
-     */
-    if (sdp_req->rctx->shutting_down) {
-        return 0;
-    }
-
     /* If there are callbacks that haven't been invoked, return
      * an error now.
      */
-- 
1.7.11.4

