From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Fri, 28 Nov 2025 03:12:10 +0000 (+0100)
Subject: [PATCH 2/5] submission-login: client - Fix panic occurring at mail_max_userip_connect... 
X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~24
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=89bab234f64933d65dec640f589bbed600acdab9;p=dovecot.git

[PATCH 2/5] submission-login: client - Fix panic occurring at mail_max_userip_connections limit transgression

Panic was:
Panic: epoll_ctl(del, 8) failed: Bad file descriptor

Fixed by making sure the underlying smtp-server connection is always closed before the connection FD is closed.

Gbp-Pq: Name 0002-submission-login-client-Fix-panic-occurring-at-mail_.patch
---

diff --git a/src/lib-smtp/smtp-server-connection.c b/src/lib-smtp/smtp-server-connection.c
index f2ef80a..c0988ea 100644
--- a/src/lib-smtp/smtp-server-connection.c
+++ b/src/lib-smtp/smtp-server-connection.c
@@ -1401,6 +1401,11 @@ void smtp_server_connection_close(struct smtp_server_connection **_conn,
 	smtp_server_connection_unref(&conn);
 }
 
+bool smtp_server_connection_is_closed(struct smtp_server_connection *conn)
+{
+	return conn->closed;
+}
+
 void smtp_server_connection_terminate(struct smtp_server_connection **_conn,
 				      const char *enh_code, const char *reason)
 {
diff --git a/src/lib-smtp/smtp-server.h b/src/lib-smtp/smtp-server.h
index 2ee7b6a..9f5bff5 100644
--- a/src/lib-smtp/smtp-server.h
+++ b/src/lib-smtp/smtp-server.h
@@ -476,6 +476,7 @@ void smtp_server_connection_set_ssl_streams(struct smtp_server_connection *conn,
 
 void smtp_server_connection_close(struct smtp_server_connection **_conn,
 				  const char *reason) ATTR_NULL(2);
+bool smtp_server_connection_is_closed(struct smtp_server_connection *conn);
 void smtp_server_connection_terminate(struct smtp_server_connection **_conn,
 				      const char *enh_code, const char *reason)
 				      ATTR_NULL(3);
diff --git a/src/submission-login/client.c b/src/submission-login/client.c
index 7d8b37e..87763b2 100644
--- a/src/submission-login/client.c
+++ b/src/submission-login/client.c
@@ -146,6 +146,21 @@ static int submission_client_create(struct client *client)
 	return 0;
 }
 
+static void
+submission_client_disconnect(struct client *client, const char *reason)
+{
+	struct submission_client *subm_client =
+		container_of(client, struct submission_client, common);
+
+	/* If the smtp-server connection is already in its close cascade (i.e.
+	   we're being called via its conn_disconnect callback), skip closing
+	   it again. Doing so would null subm_client->conn and prevent the
+	   conn_free callback from invoking client_destroy(). */
+	if (subm_client->conn != NULL &&
+	    !smtp_server_connection_is_closed(subm_client->conn))
+		smtp_server_connection_close(&subm_client->conn, reason);
+}
+
 static void submission_client_destroy(struct client *client)
 {
 	struct submission_client *subm_client =
@@ -320,6 +335,7 @@ static const struct smtp_server_callbacks smtp_callbacks = {
 static struct client_vfuncs submission_client_vfuncs = {
 	.alloc = submission_client_alloc,
 	.create = submission_client_create,
+	.disconnect = submission_client_disconnect,
 	.destroy = submission_client_destroy,
 	.reload_config = submission_client_reload_config,
 	.notify_auth_ready = submission_client_notify_auth_ready,