LRequest: destruct cgroup_xattr with the global Lua state

    
When the current Lua thread is gone already, it must not be used to
destruct the `cgroup_xattr` field.

debian/changelog

@@ -1,6 +1,6 @@
 cm4all-passage (0.16) unstable; urgency=low
 
-  * 
+  * fix use-after-free crash bug
 
  --   
 

src/Connection.cxx

@@ -135,7 +135,8 @@ try {
 
 	handler->Push(L);
 
-	NewLuaRequest(L, std::move(request), peer_cred);
+	NewLuaRequest(L, instance.GetLuaState(),
+		      std::move(request), peer_cred);
 	if (lua_pcall(L, 1, 1, 0))
 		throw Lua::PopError(L);
 

src/LRequest.cxx

@@ -289,9 +289,10 @@ RegisterLuaRequest(lua_State *L)
 }
 
 Entity *
-NewLuaRequest(lua_State *L, Entity &&src, const struct ucred &peer_cred)
+NewLuaRequest(lua_State *L, lua_State *main_L,
+	      Entity &&src, const struct ucred &peer_cred)
 {
-	return LuaRequest::New(L, L, std::move(src), peer_cred);
+	return LuaRequest::New(L, main_L, std::move(src), peer_cred);
 }
 
 Entity &

src/LRequest.hxx

@@ -11,8 +11,14 @@ struct Entity;
 void
 RegisterLuaRequest(lua_State *L);
 
+/**
+ * @param L the lua_State on whose stack the new object will be pushed
+ * @param main_L the lua_State which is used to destruct Lua values
+ * owned by the new object
+ */
 Entity *
-NewLuaRequest(lua_State *L, Entity &&src, const struct ucred &peer_cred);
+NewLuaRequest(lua_State *L, lua_State *main_L,
+	      Entity &&src, const struct ucred &peer_cred);
 
 Entity &
 CastLuaRequest(lua_State *L, int idx);