sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-11 16:58:40 +03:00
Code

smbd: Fix a panic

Browse Source 
Opening a file with a stale (smbd died) LEVEL_II oplock makes

vfs_set_filelen-> ... ->contend_level2_oplocks_begin_default

trigger the immediate leading to do_break_to_none. This goes through
because fsp->oplock_type is not initialized yet, thus 0. Also,
file_has_read_oplocks is still valid, because the smbd that has died
could not clean up the brlock.tdb entry.

Later in the code the exclusive oplock is granted, which is then found
by do_break_to_none, making it panic.

This patch just runs the direct FTRUNCATE instead of vfs_set_filelen.
This means the contend_level2_oplock code is skipped.

The relevant break (LEVEL_II to NONE) is now done in delay_for_oplock()
with the nice effect of removing a comment that was very confusing to
me.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13957
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed May 22 20:09:29 UTC 2019 on sn-devel-184
This commit is contained in:
Volker Lendecke 2019-05-21 15:26:55 +02:00 committed by Karolin Seeger
parent 42f881dd03
commit bd5116558f
2 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail
View File

@ -175,7 +175,6 @@
^samba3.smb2.dir.modify
^samba3.smb2.oplock.batch20
^samba3.smb2.oplock.stream1
^samba3.smb2.oplock.levelii502
^samba3.smb2.streams.rename
^samba3.smb2.streams.rename2
^samba3.smb2.streams.attributes

13
source3/smbd/open.c
View File

@ -1875,12 +1875,7 @@ static bool delay_for_oplock(files_struct *fsp,
break_to = e_lease_type & ~delay_mask;
if (will_overwrite) {
/*
* we'll decide about SMB2_LEASE_READ later.
*
* Maybe the break will be deferred
*/
break_to &= ~SMB2_LEASE_HANDLE;
break_to &= ~(SMB2_LEASE_HANDLE|SMB2_LEASE_READ);
}
DEBUG(10, ("entry %u: e_lease_type %u, will_overwrite: %u\n",
@ -3622,13 +3617,17 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
(!S_ISFIFO(fsp->fsp_name->st.st_ex_mode))) {
int ret;
ret = vfs_set_filelen(fsp, 0);
ret = SMB_VFS_FTRUNCATE(fsp, 0);
if (ret != 0) {
status = map_nt_error_from_unix(errno);
TALLOC_FREE(lck);
fd_close(fsp);
return status;
}
notify_fname(fsp->conn, NOTIFY_ACTION_MODIFIED,
FILE_NOTIFY_CHANGE_SIZE
| FILE_NOTIFY_CHANGE_ATTRIBUTES,
fsp->fsp_name->base_name);
}
/*