gai_cancel()

[Florian Weimer]

On 06/19/2017 01:04 PM, Phil Blundell wrote:
> On Fri, 2017-06-16 at 17:52 +0200, Florian Weimer wrote:
>> On 06/16/2017 05:46 PM, Phil Blundell wrote:
>>> Opinions?
>>
>> Is this related to bug 20874?
>>
>>   https://sourceware.org/bugzilla/show_bug.cgi?id=20874
>>
> 
> No, I don't think it's related.  I poked at that bug a bit and I am
> fairly sure that the problem there is specifically in gai_suspend(). 
> Under conditions that I don't entirely understand yet, we seem to be
> somehow returning from gai_suspend while its waitlist[] entry is still
> linked into requestlist->waiting.  Since gai_suspend() allocated its
> waitlist[] on the stack, this leads rapidly to disaster when gai_notify
> subsequently tries to traverse the linked list.

Okay, thanks for investigating.

How does the memory leak happen?  Would another notification eventually
deallocate the struct async_waitlist object?

Thanks,
Florian