1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-14 19:24:43 +03:00
Jeremy Allison 53e4650622 Fix a crash bug found by Ira Cooper <samba@ira.wakeful.net>.
A create call comes in, goes async (on the oplock request).
At a later time (just before a cancel request is received)
it completes, and goes through smbd_smb2_request_reply() to
send the reply to the create call.

However, the output socket queue is full, so when
tstream_writev_queue_send() is called from smbd_smb2_request_reply(),
the smb2req stays on the "being processed" queue on
sconn->smb2.requests, as only when tstream_writev_queue_send() completes
is smbd_smb2_request_writev_done() get called, which will TALLOC_FREE
the smb2req (and thus take if off the queue).

The cancel comes in, gets processed and looks through the
requests on the queue, and BANG - hits the smb2req that
has already been processed and is outgoing....

Remove the request from the queue once
tstream_writev_queue_send() is called and not in the talloc
destructor function.

Jeremy.
2010-06-02 16:43:31 -07:00
..
2010-04-24 10:50:12 +02:00
2010-05-18 11:45:31 +02:00
2009-11-03 11:30:00 +01:00
2010-05-31 18:21:29 +02:00
2009-05-14 16:49:18 -07:00
2010-05-21 16:56:10 -07:00
2010-05-31 18:21:29 +02:00
2010-05-31 12:04:28 +02:00
2010-05-21 16:56:10 -07:00
2010-06-01 17:09:29 -07:00