From e2ea4be95bd0fc57845cf21598184f3a8268eb12 Mon Sep 17 00:00:00 2001
From: Pavel Březina <pbrezina@redhat.com>
Date: Jan 29 2013 14:44:36 +0000
Subject: nested groups: fix group lookup hangs if member dn is incorrect


https://fedorahosted.org/sssd/ticket/1783

When dn in member attribute is invalid (e.g. rdn instead of dn)
or it is outside of configured search bases, we might hit a situation
when tevent_req is marked as done before any callback could be
attached on it.

---

diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index b587f66..a0ed775 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -1821,6 +1821,11 @@ struct sdap_nested_group_ctx {
 
     bool enable_deref;
     struct sdap_deref_ctx *derefctx;
+
+    /**
+     * FIXME: Remove me!
+     */
+    bool send_finished;
 };
 
 static errno_t sdap_nested_group_process_deref_step(struct tevent_req *req);
@@ -1857,6 +1862,7 @@ static struct tevent_req *sdap_nested_group_process_send(
     state->sh = sh;
     state->enable_deref = enable_deref;
     state->nesting_level = nesting;
+    state->send_finished = false;
 
     /* If this is too many levels deep, just return success */
     if (nesting > dp_opt_get_int(opts->basic, SDAP_NESTING_LEVEL)) {
@@ -1965,6 +1971,7 @@ static struct tevent_req *sdap_nested_group_process_send(
         if (ret != EAGAIN) goto immediate;
     }
 
+    state->send_finished = true;
     return req;
 
 immediate:
@@ -1974,6 +1981,7 @@ immediate:
         tevent_req_error(req, ret);
     }
     tevent_req_post(req, ev);
+    state->send_finished = true;
     return req;
 }
 
@@ -2504,6 +2512,14 @@ static errno_t sdap_nested_group_lookup_user(struct tevent_req *req,
             } else if (ret == EOK) {
                 DEBUG(SSSDBG_TRACE_FUNC, ("All done.\n"));
                 tevent_req_done(req);
+
+                /**
+                 * FIXME: Rewrite nested group processing so we call
+                 *        tevent_req_post() only in _send().
+                 */
+                if (state->send_finished == false) {
+                    tevent_req_post(req, state->ev);
+                }
             }
             return EOK;
         }
@@ -2588,6 +2604,14 @@ static errno_t sdap_nested_group_lookup_group(struct tevent_req *req)
         } else if (ret == EOK) {
             DEBUG(SSSDBG_TRACE_FUNC, ("All done.\n"));
             tevent_req_done(req);
+
+            /**
+             * FIXME: Rewrite nested group processing so we call
+             *        tevent_req_post() only in _send().
+             */
+            if (state->send_finished == false) {
+                tevent_req_post(req, state->ev);
+            }
         }
         return EOK;
     }