Created attachment 503906 [details]
Patch for first problem

Description of problem:
Problem 1:
in confdb_object_iter result of object_find_create is now properly
checked. object_find_create can return -1 if object doesn't exists.
Without this check, incorrect handle (memory garbage) was directly
passed to object_find_next.

Problem 2:
Following situation could happen:
- process 1 thru confdb creates find handle
- calls find iteration once
- different process 2 deletes object pointed by process 1 iterator
- process 1 calls iteration again ->
  object_find_instance->find_child_list is invalid pointer

-> segfault

Now object_find_create creates array of matching object handlers and
object_find_next uses that array together with check for name. This
prevents situation where between steps 2 and 3 new object is created
with different name but sadly with same handler.

Version-Release number of selected component (if applicable):
Corosync master

How reproducible:
Often but it's race so depends on HW, ... Problem 1 is visible in valgrind.

Steps to Reproduce:
One node.
# for i in `seq 1 5`;do (while true;do corosync-objctl -a | grep closed;done)& done 
# corosync -f
  
Actual results:
segfault

Expected results:
no segfault

Additional info: