1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-31 01:48:16 +03:00

138793 Commits

Author SHA1 Message Date
Andreas Schneider
81fc67cce2 lib:replace: Don't use deprecated readline CPPFunction cast
HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right
function.

libcli/smbreadline/smbreadline.c: In function ‘smb_readline’:
libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations]
  139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int,  int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types]
  139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
      |                                                  ^

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224

(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821)

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Thu Jan 23 15:15:06 UTC 2025 on atb-devel-224
2025-01-23 15:15:06 +00:00
Andreas Schneider
52f4e853c0 lib:replace: Remove trailing spaces from readline.h
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7)
2025-01-23 14:06:12 +00:00
Andreas Schneider
f3518ee95b lib:util: Fix stack-use-after-return in crypt_as_best_we_can()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224

(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
720ecf666f util:datablob: data_blob_pad checks its alignment assumption
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224

(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
399d56fe13 pytest: password_hash uses internal _glue.crypt
This will remove an external dependency.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
332cd9f586 samba-tool user: hashlib.sha1 is always present
We maybe thought we were checking that sha1 was in hashlib, but we were
only checking that hashlib is in the Python library (`hashlib.sha1()`
would not raise ImportError).

The documentation says hashlib always contains sha1 -- if that
changes, it is better we know by failing noisily with the import error
at the top of the file.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
0cc9a50269 samba-tool user: use _glue.crypt, not crypt.crypt
Because we know we have _glue.crypt, and we know it raises exceptions
rather than returning None, we can simplify the checks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
4004f475c4 pytest: test that _glue.crypt works
The test vectors were generated via Python 3.10 crypt module, which
directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3.

We mainly test the sha256 and sha512 vectors, which seems to be all we
use, and which are said to be widely supported.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
48297d1817 pyglue: add crypt() function
This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in
turn wraps the system crypt[_r[n]].

We want this because the Python standard library crypt module is going
away. That one also wrapped the system crypt or crypt_r, so there
should be no change.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
bbd30dc1d5 util: add a crypt strerror helper
This will be used by Python also.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
07b6b34178 dsdb:password_hash: use talloc_crypt_blob()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
9428e088b1 dsdb:password_hash: move hash_blob allocation up
This will make the next patch simpler.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6)
2025-01-23 14:06:12 +00:00
Douglas Bagnall
0dccda38f2 util: add a crypt wrapper, derived from dsdb:password_hash
This is going to be used by the dsdb password_hash module, and exposed
to Python via pyglue.

We're doing this because Python 3.13 has dropped crypt from the Python
standard library.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
(backported from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b,
Signed-off-by added)
2025-01-23 14:06:12 +00:00
Stefan Metzmacher
ff60445563 s4:dsdb: fix logic of dsdb_trust_routing_by_name()
We need to use the longest dnsname match as possible.

If we are the domain samba.example.com and have a trust
to example.com, a routing request for dc.samba.example.com
should return the tdo for samba.example.com instead
of example.com.

I reproduced the problem with the following diff:

> diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm
> index 15d7692b5d64..6e9595b784c4 100644
> --- a/selftest/target/Samba.pm
> +++ b/selftest/target/Samba.pm
> @@ -564,7 +564,7 @@ sub realm_to_ip_mappings
>  		'samba2000.example.com'           => 'dc5',
>  		'samba2003.example.com'           => 'dc6',
>  		'samba2008r2.example.com'         => 'dc7',
> -		'addom.samba.example.com'         => 'addc',
> +		'addom.samba2008r2.example.com'         => 'addc',
>  		'addom2.samba.example.com'        => 'addcsmb1',
>  		'sub.samba.example.com'           => 'localsubdc',
>  		'chgdcpassword.samba.example.com' => 'chgdcpass',
> diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
> index 0e4cf50235c3..6bca0cfd0c89 100755
> --- a/selftest/target/Samba4.pm
> +++ b/selftest/target/Samba4.pm
> @@ -2631,7 +2631,7 @@ sub setup_fl2008r2dc
>  	    return undef;
>  	}
>
> -	$env = $self->setup_trust($env, $ad_dc_vars, "forest", "");
> +	$env = $self->setup_trust($env, $ad_dc_vars, "forest", "--skip-validation");
>  	if (!defined $env) {
>  	    return undef;
>  	}
> @@ -2843,7 +2843,7 @@ sub _setup_ad_dc
>  		$server = "addc";
>  	}
>  	if (!defined($dom)) {
> -		$dom = "addom.samba.example.com";
> +		$dom = "addom.samba2008r2.example.com";
>  	}
>  	my $env = $self->provision_ad_dc($path, $server, "ADDOMAIN",
>  					 $dom,

and running:
 make -j testenv SELFTEST_TESTENV="fl2008r2dc:local"

Inside the testenv:
bin/smbclient //addc.addom.samba2008r2.example.com/netlogon \
  -U$TRUST_USERNAME@$TRUST_REALM%$TRUST_PASSWORD \
  --use-kerberos=required \
  -c 'ls'

It lets the KDC of ADDOM.SAMBA2008R2.EXAMPLE.COM to
generate a (referral) ticket for
krbtgt/SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA2008R2.EXAMPLE.COM
instead of
cifs/addc.addom.samba2008r2.example.com@ADDOM.SAMBA2008R2.EXAMPLE.COM

As ADDOM.SAMBA2008R2.EXAMPLE.COM has a forest trust (without msDS-TrustForestTrustInfo)
to SAMBA2008R2.EXAMPLE.COM dsdb_trust_update_best_tln() overwrote the
best match of addom.samba2008r2.example.com with samba2008r2.example.com.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15778

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Jan  8 04:14:47 UTC 2025 on atb-devel-224

(cherry picked from commit 56947612452c32bd26f30ad6c9767830fe608d67)

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Thu Jan  9 11:16:34 UTC 2025 on atb-devel-224
2025-01-09 11:16:34 +00:00
Stefan Metzmacher
e903d8aa33 s4:scripting: fix gen_hresult.py
Commit 6877e4849e81ed8f7f355fa4069f13a134e999ce reversed the
return values of hresult_errstr() and hresult_errstr_const().

hresult_errstr() should return "HRES_SEC_E_WRONG_PRINCIPAL",
while hresult_errstr_const() should return
"The target principal name is incorrect.".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15769

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 6e0e9c4efc86f5ec4566aa0220ed4a74ad5436c1)
2025-01-09 10:08:12 +00:00
Jule Anger
25a188f352 VERSION: Bump version up to Samba 4.21.4...
and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>
2025-01-06 16:27:48 +01:00
Jule Anger
0dba5ef975 VERSION: Disable GIT_SNAPSHOT for the 4.21.3 release.
Signed-off-by: Jule Anger <janger@samba.org>
samba-4.21.3
2025-01-06 16:27:38 +01:00
Jule Anger
d4857962df WHATSNEW: Add release notes for Samba 4.21.3.
Signed-off-by: Jule Anger <janger@samba.org>
2025-01-06 16:26:23 +01:00
Pavel Filipenský
e1c1b88170 docs:manpages: Update 'net ads keytab create'
BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Mon Dec 16 19:32:32 UTC 2024 on atb-devel-224

(cherry picked from commit 7b73c574d93668edd94f2eb18b58568d420487f4)

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Tue Dec 31 15:31:52 UTC 2024 on atb-devel-224
2024-12-31 15:31:52 +00:00
Volker Lendecke
7202467477 pam_winbind: Fix Bug 15771
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15771

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 7e8bfe738a3d91b0724d57ed54acf40ebe026c14)

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Thu Dec 19 10:13:37 UTC 2024 on atb-devel-224
2024-12-19 10:13:37 +00:00
Douglas Bagnall
884500cb31 s4:drs:test:getncchanges skips some tests with reserved_usn = 0
These tests are not affected by the reserved_usn change, so there is
no need to run them twice.

The test_repl_get_tgt_multivalued_links fails with or without
reserved_usn set to zero, but it fails differently in either case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 7dac035896b368bf3a86acf58260eef39d195d19)
2024-12-19 08:45:09 +00:00
Douglas Bagnall
5842ec1d05 s4:drs:test:getncchanges: remove timeout failure
We don't need a timeout failure any more, since replication should
always work. Leaving the timeout in might sometimes cause a flapping
test if replication is being slow for some reason.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 44a478038b6ec78aaec832d9dbde7fa6b2cdd639)
2024-12-19 08:45:09 +00:00
Douglas Bagnall
28626e763e s4:drsuapi:getncchanges: allow 0 reserved_usn reply
Azure AD will set reserved_usn to zero when we expect it to be
the number we gave them.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 7a623d8d5626b4e6c88ffb85e36f0934d89ed830)
2024-12-19 08:45:09 +00:00
Douglas Bagnall
6c66d01c6d s4:drsuapi:getncchanges: use DBG_ERR() macro
The next commit will indent this more, so it's a bit squished up.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 5ef27019033fd73decd111f9426e7f8982cbb806)
2024-12-19 08:45:09 +00:00
Douglas Bagnall
9954fd8994 s4:drsuapi:getncchanges: fix whitespace
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 2e1ccb35239fc6fe129c943bb7305bd4612d72d7)
2024-12-19 08:45:09 +00:00
Douglas Bagnall
b43b7a9ac1 s4:drs:tests: repeat getncchanges test with zero reserved_usn
This emulates the behaviour of Azure AD.

As this is quite slow we will later reduce the test load in this case,
but for now we want to run all the getncchanges tests this way.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 67c7609ab755291de27c620120a1c71b557452e4)
2024-12-19 08:45:09 +00:00
Douglas Bagnall
ec6263a3f0 s4:drs:tests: add hook for changing highwatermark
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 796e92a530004406dcb3fea33f54833c722480a0)
2024-12-19 08:45:09 +00:00
Douglas Bagnall
9b7f1ce151 s4:drs:test:getncchanges: add a timeout failure
In the next commit we are going to add tests in which the client
modifies the highwatermark in a way that resets replication (on Samba
only). After that we'll fix it.

If we leave the test in an eternal loop, the commit history will not
be bisectable, so we are temporarily going to turn long waits into
failures.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15701

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <josutton@catalyst.net.nz>
(cherry picked from commit 4b4a7c3fd465267c43d9586ab79ca8f84c0cad24)
2024-12-19 08:45:09 +00:00
Pavel Filipenský
ba4363a727 selftest: Add test for vfs crossrename module
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 02d4f58a2f7ac2db60dd2e4d16a3cbf71b3f08a9)
2024-12-19 08:45:09 +00:00
Pavel Filipenský
bab50c88c7 docs:manpage: vfs_crossrename is not fully stackable VFS module
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 94c9a99c56db438c391a966c927ec2f862c373e7)
2024-12-19 08:45:09 +00:00
Jones Syue
6b37df9e58 s3:vfs_crossrename: add back checking for errno ENOENT
strace gives a clue: samba try to remove 'file.txt' in the dst folder but
actually it is not existed yet, and got an errno = ENOENT,

renameat(32, "file.txt", 31, "file.txt") = -1 EXDEV (Invalid cross-device link)
unlinkat(31, "file.txt", 0)             = -1 ENOENT (No such file or directory)

Commit 5c18f074be92 ("s3: VFS: crossrename. Use real dirfsp for
SMB_VFS_RENAMEAT()") seems unintentionally removed errno ENOENT checking,
so add it back could address 1st issue.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Jones Syue <jonessyue@qnap.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 1a089a16c40e0b3bc5d4fcde559157cf137056c2)
2024-12-19 08:45:09 +00:00
Pavel Filipenský
bca095a71a s3:vfs_crossrename: crossrename_renameat() needs to return 0 if copy_reg() is successful
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 0a9adc85e77bc557bb8be12237fa31c4142dd3d5)
2024-12-19 08:45:09 +00:00
Pavel Filipenský
7219acad07 s3:vfs_crossrename: avoid locking panic in copy_reg()
Use low level backend functions that don't go through the FSA layer.
Done via calling transfer_file() as it was in version before 5c18f07

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 0a5da82f75a43838be3419cab10a50750fa500d7)
2024-12-19 08:45:09 +00:00
Stefan Metzmacher
aee855de33 s4:rpc_server: make use of dcesrv_assoc_group_common_destructor()
Currently this should not be needed, but it's better to
call dcesrv_assoc_group_common_destructor() in all assoc_group
destructors.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 19657be71d7cec5ac58a5d6969dc1d6ae7c5b517)

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Mon Dec 16 17:36:29 UTC 2024 on atb-devel-224
2024-12-16 17:36:29 +00:00
Stefan Metzmacher
b7d2e29c59 s3:rpc_server: make use of dcesrv_assoc_group_common_destructor()
We need to detach dcesrv_iface_state from dcesrv_assoc_group,
if dcesrv_assoc_group is free'ed first.

Typically this doesn't happen, but it does when
rpc_worker_connection_terminated explicitly calls
talloc_unlink(conn, conn->assoc_group)
and dcesrv_iface_state_store_conn() is used.

But we better do it in all assoc_group destructors.

==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778
READ of size 8 at 0x50d000004f80 thread T0
    #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166
    #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080
    #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764
    #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360
    #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115

0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98)
freed by thread T0 here:
    #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222
    #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473
    #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143
    #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175
    #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234

previously allocated by thread T0 here:
    #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783
    #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825
    #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982
    #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421
    #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681
    #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730
    #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158
    #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324
    #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222
    #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489
    #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558
    #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343
    #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371
    #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431
    #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144
    #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426
    #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316
    #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 627a7857844804a29c6612df5da4605c94edb3f9)
2024-12-16 16:14:11 +00:00
Stefan Metzmacher
f2ed20c201 dcesrv_core: add dcesrv_assoc_group_common_destructor()
We need to detach dcesrv_iface_state from dcesrv_assoc_group,
if dcesrv_assoc_group is free'ed first.

==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778
READ of size 8 at 0x50d000004f80 thread T0
    #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166
    #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080
    #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764
    #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360
    #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115

0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98)
freed by thread T0 here:
    #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222
    #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473
    #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143
    #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175
    #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234

previously allocated by thread T0 here:
    #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783
    #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825
    #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982
    #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421
    #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681
    #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730
    #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158
    #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324
    #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222
    #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489
    #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558
    #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343
    #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371
    #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431
    #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144
    #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426
    #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316
    #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 5b929860e269e2968a0ec3759a6125ae990b43c3)
2024-12-16 16:14:11 +00:00
Ralph Boehme
e47866ae94 smbd: fix breaking leases on rename
We must also break leases on other opens if the open of the rename doesn't have
a lease itself. The existing test test_lease_v2_rename() that was added
alongside the deferred rename server code didn't cover this case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Oct 31 12:47:24 UTC 2024 on atb-devel-224

(cherry picked from commit efbbe8d6f80ceb6107f20486623eee949409c0ff)

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Mon Dec  9 16:21:19 UTC 2024 on atb-devel-224
2024-12-09 16:21:19 +00:00
Ralph Boehme
4eaf7b8b85 smbd: force sync rename with lease break
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit bc2d87981967bc65155ba09eb5b3e3f913bec50e)
2024-12-09 15:10:18 +00:00
Ralph Boehme
b8a543f2cc smbd: return correct error for compound related requests that went async
For a compound related request chain of eg CREATE+NOTIFY+GETINFO, the NOTIFY
will typically go async. When this is noted in smbd_smb2_request_pending_queue()
the pending async tevent_req is cancelled which means we return
NT_STATUS_CANCELLED to the client while Windows returns
NT_STATUS_INTERNAL_ERROR.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit a5635791cfdb10f64bf2bf7c72c58f7591249a0d)
2024-12-09 15:10:18 +00:00
Ralph Boehme
ebe5e4c349 smbtorture: test rename with other opens on the file
Windows allows this. Samba also already implements this correctly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 3890ac2fafc5e17919fa39542440a05ef72a3fa5)
2024-12-09 15:10:18 +00:00
Ralph Boehme
52b1c6aba3 smbtorture: add a bunch of tests for async rename and async interim responses
All tests pass against Windows 2022, we have some bugs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 42e739ab62cb573d72215737027cf3c7f1fcd212)
2024-12-09 15:10:18 +00:00
Ralph Boehme
52c3f27061 smbtorture: rename CHECK_VALUE() to CHECK_VAL() in smb2/compound.c
Prepares for using macros from lease_break_handler.h which makes use of
CHECK_VAL() while relying on a definition of CHECK_VAL() in the .c file.

While at it, add a goto done which is always a good thing to get clear failures
from tests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 4932b433ff2f1c4e603073624a5d22140acfb2ed)
2024-12-09 15:10:17 +00:00
Andreas Schneider
0f4e46398b vfs_btrfs: Also call vfs_offload_token_ctx_init() in btrfs_offload_write_send()
If a client for whatever reason calls FSCTL_SRV_COPYCHUNK[_WRITE] without
FSCTL_SRV_REQUEST_RESUME_KEY, we call btrfs_offload_write_send
before btrfs_offload_read_send.

This is similar to 462b74da79c51f9ba6dbd24e603aa904485d5123

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15758

Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Tue Dec  3 18:04:26 UTC 2024 on atb-devel-224
2024-12-03 18:04:26 +00:00
Martin Schwenke
9a7047e8cc ctdb-common: Map ENOENT for a missing event script to ENOEXEC
This handles the case where an event script is disabled by unlinking,
while an event is being run, after the script list has been created.
Without this change the script will fail.  With this change the script
will be marked as DISABLED.  See the comment added by this commit for
more details.

Add a testcase to simulate the race, using an event script to disable
subsequent ones.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15755
RN: Avoid event failure race when disabling an event script

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Nov 21 01:42:09 UTC 2024 on atb-devel-224

(cherry picked from commit fee31b6cb2b8f7dd111bdd9d2ff5479c31cbca37)
2024-12-03 16:44:18 +00:00
Jule Anger
a01a0c34da VERSION: Bump version up to Samba 4.21.3...
and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>
2024-11-25 16:01:52 +01:00
Jule Anger
d67152765b VERSION: Disable GIT_SNAPSHOT for the 4.21.2 release.
Signed-off-by: Jule Anger <janger@samba.org>
samba-4.21.2
2024-11-25 16:01:38 +01:00
Jule Anger
c8e1d81697 WHATSNEW: Add release notes for Samba 4.21.2.
Signed-off-by: Jule Anger <janger@samba.org>
2024-11-25 16:01:01 +01:00
Martin Schwenke
8da34956d6 ctdb-scripts: Track connections for all ports for public IPs
Currently TCP ports like NFS lock manager are not tracked.  It is
easier to track all connections than to add a configuration system to
try to track specified ports, so do that.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 590a86dbe4adf45ac8d15497934e25ea98148034)

Autobuild-User(v4-21-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-21-test): Mon Nov 25 14:09:18 UTC 2024 on atb-devel-224
2024-11-25 14:09:18 +00:00
Martin Schwenke
53df2b78ae ctdb-scripts: Get connections after tickle list
Running ss to get current connections before running ctdb gettickles
means the ss output might be out of date when the 2 lists are
compared.  Some tickles might have been added after ss was run by some
other means (e.g. SMB tickles, added internally) and they would be
deleted according to the stale ss output.

This isn't currently a problem because update_tickles() is currently
only called with port 2049, so all tickles are managed by this code.
That will change in a subsequent commit.

Changing the order means the reverse problem can occur, where
update_tickles() attempts to delete an already deleted tickle.  That
may happen occasionally but is harmless because it doesn't result in
missing information.  It (currently) just causes a message to be
logged at DEBUG level.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit c3695722b6316b624aa6c44cad4f44279303d1b1)
2024-11-25 12:38:16 +00:00
Martin Schwenke
f5fc8aa709 ctdb-scripts: Move connection tracking to 10.interface
This should really be done for all connections to public IP addresses.
Leave the port number there for now - this is just the first step.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 9683bb3ac2bbdf0e83c3be3681f9d1c8ee7cc327)
2024-11-25 12:38:16 +00:00