File 0019-MONITOR-Adjust-ping-canceling.patch of Package sssd.11069

From 0431975b64342eed78a71786b33e450603824ede Mon Sep 17 00:00:00 2001
From: Josef Cejka <jcejka@suse.com>
Date: Mon, 22 Apr 2019 15:45:11 +0200
Subject: [PATCH 23/23] MONITOR: Adjust ping canceling

svc->pending holds only a single reference to the last send ping.
The monitor has to cancel it before sending new one otherwise
the reference will be lost.

The timeout for handler that sends pings (tasks_check_handler) is
the same like the timeout for pings iself (svc->ping_time).
Increasing slightly the first one gives us some time to handle
the ping responses before they will be canceled.

Ping holds pointer to struct mt_svc and the same value is returned
in response on ping.
If the reference to send ping is lost and we have to destroy
corresponding struct mt_svc, the ping cannot be canceled. Later
can arrive ping response with already invalid pointer to mt_svc that
will cause monitor crash.
---
 src/monitor/monitor.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index 03134181c..4464488af 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -343,6 +343,7 @@ static int svc_destructor(void *mem)
     /* Cancel any pending pings */
     if (svc->pending) {
         dbus_pending_call_cancel(svc->pending);
+        dbus_pending_call_unref(svc->pending);
     }
 
     /* svc is being freed, neutralize the spy */
@@ -605,7 +606,7 @@ static void set_tasks_checker(struct mt_svc *svc)
     struct timeval tv;
 
     gettimeofday(&tv, NULL);
-    tv.tv_sec += svc->ping_time;
+    tv.tv_sec += svc->ping_time + 1;
     tv.tv_usec = 0;
     te = tevent_add_timer(svc->mt_ctx->ev, svc, tv, tasks_check_handler, svc);
     if (te == NULL) {
@@ -2575,6 +2576,18 @@ static int service_send_ping(struct mt_svc *svc)
         return ENOMEM;
     }
 
+    /* Cancel any pending pings */
+    if (svc->pending) {
+        dbus_pending_call_cancel(svc->pending);
+        dbus_pending_call_unref(svc->pending);
+        svc->pending = NULL;
+        DEBUG(SSSDBG_CRIT_FAILURE,
+                "A service PING timed out on [%s]. "
+                "Attempt [%d]\n",
+                svc->name, svc->failed_pongs);
+        svc->failed_pongs++;
+    }
+
     ret = sbus_conn_send(svc->conn, msg,
                          svc->ping_time * 1000, /* milliseconds */
                          ping_check, svc, &svc->pending);
-- 
2.21.0