unregister_mibs_by_session pulling the carpet from below netsnmp_remove_delegated_requests_for_session's feet?

For some time now we are chasing a bug where snmpd crashes when an 
agentx subagent is non-responsive. I have the slight feeling that we are 
not alone, as the following bugs describe a similar problem:

[ 1097029 ] snmpd dies during snmpwalk and (dis)connecting subagent
[ 1491604 ] snmpd crash with getnext
[ 1574285 ] snmpd crash when agentx subagent crash
[ 1565703 ] SNMPD crash in net-snmp-5.2.2
[ 1403948 ] 5.1.3.1 snmpd crashes shortly after startup (mein alter)

I have come to a piece of code that I do not understand:

in close_agentx_session(session, -1),
unregister_mibs_by_session(session) is called, which, in turn, calls 
netsnmp_subtree_free(child). Later in close_agentx_session(), 
netsnmp_remove_delegated_requests_for_session tries to find all requests 
that reference a given subtree. However, as it turns out, this subtree 
has just been free'd by the netsnmp_subtree_free call in 
unregister_mibs_by_session mentioned above!

If request->subtree is a (pointer) copy of contextptr->first_subtree, 
then the sequence if obviously wrong!

Or is it?

Josef
-- 
Josef Möllers (Pinguinpfleger bei FSC)
	If failure had no penalty success would not be a prize
						-- T.  Pratchett

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users