tree a30a1cd2f4d781ff26dff9da5c5546d1c9959a0b
parent 2b34e92d0e2de3b63636b1e2e2d5eb1bd850c10c
author Daniel Willmann <dwillmann@sysmocom.de> 1691657245 +0200
committer Daniel Willmann <dwillmann@sysmocom.de> 1692890013 +0200

osmo_io: Avoid potential double free when sending msgb

Ensure that a msgb  has the proper talloc parent:

All msgbs inside an iofd get the iofd as parent. Received msgbs are reparented
to iofd->msgb_alloc.ctx (which was set in osmo_iofd_setup()) before
being passed to the receive callback.

Before this change the code could fail for msgbs that are submitted via uring
where the (failed) write returns after the iofd has already been
osmo_iofd_free()d. free()ing the iofd is deferred until the write
completes, but the (iofd) parent context could have been free()d in the
meantime.

Change-Id: I3a279b55a3adff96948120683c844e1508d0ba94