s3: smbd: Don't loop infinitely on bad-symlink resolution.
commitf289980e5531372dd63ec483e265e48efb8cf207
authorJeremy Allison <jra@samba.org>
Wed, 15 Feb 2017 23:42:52 +0000 (15 15:42 -0800)
committerKarolin Seeger <kseeger@samba.org>
Fri, 17 Feb 2017 11:26:21 +0000 (17 12:26 +0100)
treeaa5c56eefa835f01e6bc0b34427400d31f4d83c3
parentc553d9f74f1609e82bddfcbda3395b2ac29cec15
s3: smbd: Don't loop infinitely on bad-symlink resolution.

In the FILE_OPEN_IF case we have O_CREAT, but not
O_EXCL. Previously we went into a loop trying first
~(O_CREAT|O_EXCL), and if that returned ENOENT
try (O_CREAT|O_EXCL). We kept looping indefinately
until we got an error, or the file was created or
opened.

The big problem here is dangling symlinks. Opening
without O_NOFOLLOW means both bad symlink
and missing path return -1, ENOENT from open(). As POSIX
is pathname based it's not possible to tell
the difference between these two cases in a
non-racy way, so change to try only two attempts before
giving up.

We don't have this problem for the O_NOFOLLOW
case as we just return NT_STATUS_OBJECT_PATH_NOT_FOUND
mapped from the ELOOP POSIX error and immediately
returned.

Unroll the loop logic to two tries instead.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12572

Pair-programmed-with: Ralph Boehme <slow@samba.org>

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 10c3e3923022485c720f322ca4f0aca5d7501310)
source3/smbd/open.c