| commit | 64c0367335fab0137e65f8cfa35af77ff854f654 | |
| author | Volker Lendecke <vl@samba.org> | |
| Tue, 7 Aug 2012 20:25:53 +0000 (7 22:25 +0200) | ||
| committer | Jeremy Allison <jra@samba.org> | |
| Wed, 8 Aug 2012 02:12:04 +0000 (8 04:12 +0200) | ||
| tree | a7a2d06943761f2b541d94ef73145205d09c0f7c | treesnapshot (tar.gz zip) |
| parent | c2dee12d678234126648d150f6f03165a2b7c95b | commitdiff |
s3: Fix a crash in reply_lockingX_error
A timed brlock with 2 locks comes in and the second one blocks,
file is closed. smbd_cancel_pending_lock_requests_by_fid sets
blr->fsp to NULL. reply_lockingX_error (called via
MSG_SMB_BLOCKING_LOCK_CANCEL) deferences blr->fsp because
blr->lock_num==1 (the second one blocked).
This patch fixes the bug by only undoing the locks if fsp!=NULL.
fsp==NULL is the close case where everything is undone anyway.
Thanks to Peter Somogyi, somogyi@hu.ibm.com for this bug report.
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Aug 8 04:12:04 CEST 2012 on sn-devel-104
A timed brlock with 2 locks comes in and the second one blocks,
file is closed. smbd_cancel_pending_lock_requests_by_fid sets
blr->fsp to NULL. reply_lockingX_error (called via
MSG_SMB_BLOCKING_LOCK_CANCEL) deferences blr->fsp because
blr->lock_num==1 (the second one blocked).
This patch fixes the bug by only undoing the locks if fsp!=NULL.
fsp==NULL is the close case where everything is undone anyway.
Thanks to Peter Somogyi, somogyi@hu.ibm.com for this bug report.
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Aug 8 04:12:04 CEST 2012 on sn-devel-104
| source3/smbd/blocking.c | diffblobblamehistory |