Attachment 16729 Details for Bug 14769 – git-am fix for 4.15.rcNext.

[patch] git-am fix for 4.15.rcNext.

bug-14769-4.15.patch (text/plain), 20.56 KB, created by Jeremy Allison on 2021-08-11 20:56:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2021-08-11 20:56:19 UTC

Size: 20.56 KB

patch

obsolete

>From 4308efcb48fe9d72dda5fce24b3231eae813234f Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Thu, 5 Aug 2021 13:14:16 -0700
>Subject: [PATCH 1/6] s3: smbd: Split out smb2_ioctl_smbtorture() into a
> separate file.
>
>We will be adding async supporting code to this, and we don't want to
>clutter up smb2_ioctl.c.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14769
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit 6b6770c2ba83bf25da31623443c19a8de34e5ba4)
>---
> source3/smbd/smb2_ioctl.c            |  68 ------------------
> source3/smbd/smb2_ioctl_private.h    |   5 ++
> source3/smbd/smb2_ioctl_smbtorture.c | 100 +++++++++++++++++++++++++++
> source3/wscript_build                |   1 +
> 4 files changed, 106 insertions(+), 68 deletions(-)
> create mode 100644 source3/smbd/smb2_ioctl_smbtorture.c
>
>diff --git a/source3/smbd/smb2_ioctl.c b/source3/smbd/smb2_ioctl.c
>index d29ff5d0303..8154d3d8bfa 100644
>--- a/source3/smbd/smb2_ioctl.c
>+++ b/source3/smbd/smb2_ioctl.c
>@@ -381,74 +381,6 @@ static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq)
> 	}
> }
> 
>-static struct tevent_req *smb2_ioctl_smbtorture(uint32_t ctl_code,
>-					struct tevent_context *ev,
>-					struct tevent_req *req,
>-					struct smbd_smb2_ioctl_state *state)
>-{
>-	NTSTATUS status;
>-	bool ok;
>-
>-	ok = lp_parm_bool(-1, "smbd", "FSCTL_SMBTORTURE", false);
>-	if (!ok) {
>-		goto not_supported;
>-	}
>-
>-	switch (ctl_code) {
>-	case FSCTL_SMBTORTURE_FORCE_UNACKED_TIMEOUT:
>-		if (state->in_input.length != 0) {
>-			tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
>-			return tevent_req_post(req, ev);
>-		}
>-
>-		state->smb2req->xconn->ack.force_unacked_timeout = true;
>-		tevent_req_done(req);
>-		return tevent_req_post(req, ev);
>-
>-	case FSCTL_SMBTORTURE_IOCTL_RESPONSE_BODY_PADDING8:
>-		if (state->in_input.length != 0) {
>-			tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
>-			return tevent_req_post(req, ev);
>-		}
>-
>-		if (state->in_max_output > 0) {
>-			uint32_t size = state->in_max_output;
>-
>-			state->out_output = data_blob_talloc(state, NULL, size);
>-			if (tevent_req_nomem(state->out_output.data, req)) {
>-				return tevent_req_post(req, ev);
>-			}
>-			memset(state->out_output.data, 8, size);
>-		}
>-
>-		state->body_padding = 8;
>-		tevent_req_done(req);
>-		return tevent_req_post(req, ev);
>-
>-	case FSCTL_SMBTORTURE_GLOBAL_READ_RESPONSE_BODY_PADDING8:
>-		if (state->in_input.length != 0) {
>-			tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
>-			return tevent_req_post(req, ev);
>-		}
>-
>-		state->smb2req->xconn->smb2.smbtorture.read_body_padding = 8;
>-		tevent_req_done(req);
>-		return tevent_req_post(req, ev);
>-	default:
>-		goto not_supported;
>-	}
>-
>-not_supported:
>-	if (IS_IPC(state->smbreq->conn)) {
>-		status = NT_STATUS_FS_DRIVER_REQUIRED;
>-	} else {
>-		status = NT_STATUS_INVALID_DEVICE_REQUEST;
>-	}
>-
>-	tevent_req_nterror(req, status);
>-	return tevent_req_post(req, ev);
>-}
>-
> static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
> 					       struct tevent_context *ev,
> 					       struct smbd_smb2_request *smb2req,
>diff --git a/source3/smbd/smb2_ioctl_private.h b/source3/smbd/smb2_ioctl_private.h
>index 7a35f8f5d0b..d653c107d3d 100644
>--- a/source3/smbd/smb2_ioctl_private.h
>+++ b/source3/smbd/smb2_ioctl_private.h
>@@ -52,4 +52,9 @@ struct tevent_req *smb2_ioctl_network_fs(uint32_t,
> 					 struct tevent_req *,
> 					 struct smbd_smb2_ioctl_state *);
> 
>+struct tevent_req *smb2_ioctl_smbtorture(uint32_t ctl_code,
>+					 struct tevent_context *ev,
>+					 struct tevent_req *req,
>+					 struct smbd_smb2_ioctl_state *state);
>+
> #endif
>diff --git a/source3/smbd/smb2_ioctl_smbtorture.c b/source3/smbd/smb2_ioctl_smbtorture.c
>new file mode 100644
>index 00000000000..cc2c8ac55fe
>--- /dev/null
>+++ b/source3/smbd/smb2_ioctl_smbtorture.c
>@@ -0,0 +1,100 @@
>+/*
>+   Unix SMB/CIFS implementation.
>+   Core SMB2 server
>+
>+   Copyright (C) Stefan Metzmacher 2009
>+   Copyright (C) Jeremy Allison 2021
>+
>+   This program is free software; you can redistribute it and/or modify
>+   it under the terms of the GNU General Public License as published by
>+   the Free Software Foundation; either version 3 of the License, or
>+   (at your option) any later version.
>+
>+   This program is distributed in the hope that it will be useful,
>+   but WITHOUT ANY WARRANTY; without even the implied warranty of
>+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>+   GNU General Public License for more details.
>+
>+   You should have received a copy of the GNU General Public License
>+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
>+*/
>+
>+#include "includes.h"
>+#include "smbd/smbd.h"
>+#include "smbd/globals.h"
>+#include "../libcli/smb/smb_common.h"
>+#include "../lib/util/tevent_ntstatus.h"
>+#include "include/ntioctl.h"
>+#include "smb2_ioctl_private.h"
>+#include "librpc/gen_ndr/ioctl.h"
>+
>+#undef DBGC_CLASS
>+#define DBGC_CLASS DBGC_SMB2
>+
>+struct tevent_req *smb2_ioctl_smbtorture(uint32_t ctl_code,
>+					 struct tevent_context *ev,
>+					 struct tevent_req *req,
>+					 struct smbd_smb2_ioctl_state *state)
>+{
>+	NTSTATUS status;
>+	bool ok;
>+
>+	ok = lp_parm_bool(-1, "smbd", "FSCTL_SMBTORTURE", false);
>+	if (!ok) {
>+		goto not_supported;
>+	}
>+
>+	switch (ctl_code) {
>+	case FSCTL_SMBTORTURE_FORCE_UNACKED_TIMEOUT:
>+		if (state->in_input.length != 0) {
>+			tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
>+			return tevent_req_post(req, ev);
>+		}
>+
>+		state->smb2req->xconn->ack.force_unacked_timeout = true;
>+		tevent_req_done(req);
>+		return tevent_req_post(req, ev);
>+
>+	case FSCTL_SMBTORTURE_IOCTL_RESPONSE_BODY_PADDING8:
>+		if (state->in_input.length != 0) {
>+			tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
>+			return tevent_req_post(req, ev);
>+		}
>+
>+		if (state->in_max_output > 0) {
>+			uint32_t size = state->in_max_output;
>+
>+			state->out_output = data_blob_talloc(state, NULL, size);
>+			if (tevent_req_nomem(state->out_output.data, req)) {
>+				return tevent_req_post(req, ev);
>+			}
>+			memset(state->out_output.data, 8, size);
>+		}
>+
>+		state->body_padding = 8;
>+		tevent_req_done(req);
>+		return tevent_req_post(req, ev);
>+
>+	case FSCTL_SMBTORTURE_GLOBAL_READ_RESPONSE_BODY_PADDING8:
>+		if (state->in_input.length != 0) {
>+			tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
>+			return tevent_req_post(req, ev);
>+		}
>+
>+		state->smb2req->xconn->smb2.smbtorture.read_body_padding = 8;
>+		tevent_req_done(req);
>+		return tevent_req_post(req, ev);
>+	default:
>+		goto not_supported;
>+	}
>+
>+not_supported:
>+	if (IS_IPC(state->smbreq->conn)) {
>+		status = NT_STATUS_FS_DRIVER_REQUIRED;
>+	} else {
>+		status = NT_STATUS_INVALID_DEVICE_REQUEST;
>+	}
>+
>+	tevent_req_nterror(req, status);
>+	return tevent_req_post(req, ev);
>+}
>diff --git a/source3/wscript_build b/source3/wscript_build
>index 55851c7b3a6..69febb53750 100644
>--- a/source3/wscript_build
>+++ b/source3/wscript_build
>@@ -663,6 +663,7 @@ bld.SAMBA3_LIBRARY('smbd_base',
>                           smbd/smb2_ioctl_filesys.c
>                           smbd/smb2_ioctl_named_pipe.c
>                           smbd/smb2_ioctl_network_fs.c
>+                          smbd/smb2_ioctl_smbtorture.c
>                           smbd/smb2_keepalive.c
>                           smbd/smb2_query_directory.c
>                           smbd/smb2_notify.c
>-- 
>2.30.2
>
>
>From 32c6a1b28900b9e97054c9ec46b6798653cced52 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Thu, 5 Aug 2021 11:01:44 -0700
>Subject: [PATCH 2/6] s3: libcli: Add FSCTL_SMBTORTURE_FSP_ASYNC_SLEEP.
>
>Prepare for async FSCTL tests on an fsp.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14769
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit 62cd95096a76d5064b105c1b4971fa3eabd5f85d)
>---
> libcli/smb/smb_constants.h | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h
>index a12086e602b..a043cbc883e 100644
>--- a/libcli/smb/smb_constants.h
>+++ b/libcli/smb/smb_constants.h
>@@ -599,6 +599,8 @@ enum csc_policy {
> 	(FSCTL_SMBTORTURE | FSCTL_ACCESS_WRITE | 0x0010 | FSCTL_METHOD_NEITHER)
> #define FSCTL_SMBTORTURE_GLOBAL_READ_RESPONSE_BODY_PADDING8 \
> 	(FSCTL_SMBTORTURE | FSCTL_ACCESS_WRITE | 0x0020 | FSCTL_METHOD_NEITHER)
>+#define FSCTL_SMBTORTURE_FSP_ASYNC_SLEEP \
>+	(FSCTL_SMBTORTURE | FSCTL_ACCESS_WRITE | 0x0040 | FSCTL_METHOD_NEITHER)
> 
> /*
>  * A few values from [MS-FSCC] 2.1.2.1 Reparse Tags
>-- 
>2.30.2
>
>
>From 622a6be886b469adb6f12ac58f43efea705915e5 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Thu, 5 Aug 2021 16:04:38 -0700
>Subject: [PATCH 3/6] s3: smbd: Add smbd_fsctl_torture_async_sleep()
> server-side code.
>
>Commented out as not yet called.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14769
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit 0f4a8d26888ec156979a00480ed9886dcac7d426)
>---
> source3/smbd/smb2_ioctl_smbtorture.c | 103 +++++++++++++++++++++++++++
> 1 file changed, 103 insertions(+)
>
>diff --git a/source3/smbd/smb2_ioctl_smbtorture.c b/source3/smbd/smb2_ioctl_smbtorture.c
>index cc2c8ac55fe..43abef78f3e 100644
>--- a/source3/smbd/smb2_ioctl_smbtorture.c
>+++ b/source3/smbd/smb2_ioctl_smbtorture.c
>@@ -31,6 +31,109 @@
> #undef DBGC_CLASS
> #define DBGC_CLASS DBGC_SMB2
> 
>+#if 0
>+struct async_sleep_state {
>+	struct smbd_server_connection *sconn;
>+	files_struct *fsp;
>+};
>+
>+static void smbd_fsctl_torture_async_sleep_done(struct tevent_req *subreq);
>+
>+static struct tevent_req *smbd_fsctl_torture_async_sleep_send(
>+				TALLOC_CTX *mem_ctx,
>+				struct tevent_context *ev,
>+				files_struct *fsp,
>+				uint8_t msecs)
>+{
>+	struct async_sleep_state *state = NULL;
>+	struct tevent_req *subreq = NULL;
>+	bool ok;
>+
>+	subreq = tevent_req_create(mem_ctx,
>+				&state,
>+				struct async_sleep_state);
>+	if (!subreq) {
>+		return NULL;
>+	}
>+
>+	/*
>+	 * Store the conn separately, as the test is to
>+	 * see if fsp is still a valid pointer, so we can't
>+	 * do anything other than test it for entry in the
>+	 * open files on this server connection.
>+	 */
>+	state->sconn = fsp->conn->sconn;
>+	state->fsp = fsp;
>+
>+	/*
>+	 * Just wait for the specified number of micro seconds,
>+	 * to allow the client time to close fsp.
>+	 */
>+	ok = tevent_req_set_endtime(subreq,
>+				    ev,
>+				    timeval_current_ofs(0, msecs));
>+	if (!ok) {
>+		tevent_req_nterror(subreq, NT_STATUS_NO_MEMORY);
>+		return tevent_req_post(subreq, ev);
>+	}
>+
>+	return subreq;
>+}
>+
>+static files_struct *find_my_fsp(struct files_struct *fsp,
>+				 void *private_data)
>+{
>+	struct files_struct *myfsp = (struct files_struct *)private_data;
>+
>+	if (fsp == myfsp) {
>+		return myfsp;
>+	}
>+	return NULL;
>+}
>+
>+static bool smbd_fsctl_torture_async_sleep_recv(struct tevent_req *subreq)
>+{
>+	tevent_req_received(subreq);
>+	return true;
>+}
>+
>+static void smbd_fsctl_torture_async_sleep_done(struct tevent_req *subreq)
>+{
>+	struct files_struct *found_fsp;
>+	struct tevent_req *req = tevent_req_callback_data(
>+					subreq,
>+					struct tevent_req);
>+	struct async_sleep_state *state = tevent_req_data(
>+					subreq,
>+					struct async_sleep_state);
>+
>+	/* Does state->fsp still exist on state->sconn ? */
>+	found_fsp = files_forall(state->sconn,
>+				 find_my_fsp,
>+				 state->fsp);
>+
>+	smbd_fsctl_torture_async_sleep_recv(subreq);
>+	TALLOC_FREE(subreq);
>+
>+	if (found_fsp == NULL) {
>+		/*
>+		 * We didn't find it - return an error to the
>+		 * smb2 ioctl request. Use NT_STATUS_FILE_CLOSED so
>+		 * the client can tell the difference between
>+		 * a bad fsp handle and
>+		 *
>+		 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=14769
>+		 *
>+		 * This request should block file closure until it
>+		 * has completed.
>+		 */
>+		tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
>+		return;
>+	}
>+	tevent_req_done(req);
>+}
>+#endif
>+
> struct tevent_req *smb2_ioctl_smbtorture(uint32_t ctl_code,
> 					 struct tevent_context *ev,
> 					 struct tevent_req *req,
>-- 
>2.30.2
>
>
>From 1ca7a6581f87edd0900cc3784459c49487ac8980 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Thu, 5 Aug 2021 16:07:09 -0700
>Subject: [PATCH 4/6] s3: smbd: Call smbd_fsctl_torture_async_sleep() when we
> get FSCTL_SMBTORTURE_FSP_ASYNC_SLEEP.
>
>Now all we need is the client-side test.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14769
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit c551d33c6bd2e74ea3a36bec5575a70d6833b98a)
>---
> source3/smbd/smb2_ioctl_smbtorture.c | 31 ++++++++++++++++++++++++++--
> 1 file changed, 29 insertions(+), 2 deletions(-)
>
>diff --git a/source3/smbd/smb2_ioctl_smbtorture.c b/source3/smbd/smb2_ioctl_smbtorture.c
>index 43abef78f3e..9a259fb0dbf 100644
>--- a/source3/smbd/smb2_ioctl_smbtorture.c
>+++ b/source3/smbd/smb2_ioctl_smbtorture.c
>@@ -31,7 +31,6 @@
> #undef DBGC_CLASS
> #define DBGC_CLASS DBGC_SMB2
> 
>-#if 0
> struct async_sleep_state {
> 	struct smbd_server_connection *sconn;
> 	files_struct *fsp;
>@@ -132,7 +131,6 @@ static void smbd_fsctl_torture_async_sleep_done(struct tevent_req *subreq)
> 	}
> 	tevent_req_done(req);
> }
>-#endif
> 
> struct tevent_req *smb2_ioctl_smbtorture(uint32_t ctl_code,
> 					 struct tevent_context *ev,
>@@ -187,6 +185,35 @@ struct tevent_req *smb2_ioctl_smbtorture(uint32_t ctl_code,
> 		state->smb2req->xconn->smb2.smbtorture.read_body_padding = 8;
> 		tevent_req_done(req);
> 		return tevent_req_post(req, ev);
>+
>+	case FSCTL_SMBTORTURE_FSP_ASYNC_SLEEP: {
>+		struct tevent_req *subreq = NULL;
>+
>+		/* Data is 1 byte of CVAL stored seconds to delay for. */
>+		if (state->in_input.length != 1) {
>+			tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
>+			return tevent_req_post(req, ev);
>+		}
>+		if (state->fsp == NULL) {
>+			tevent_req_nterror(req, NT_STATUS_INVALID_HANDLE);
>+			return tevent_req_post(req, ev);
>+		}
>+
>+		subreq = smbd_fsctl_torture_async_sleep_send(
>+						req,
>+						ev,
>+						state->fsp,
>+						CVAL(state->in_input.data,0));
>+		if (subreq == NULL) {
>+			tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
>+			return tevent_req_post(req, ev);
>+		}
>+		tevent_req_set_callback(subreq,
>+					smbd_fsctl_torture_async_sleep_done,
>+					req);
>+		return req;
>+        }
>+
> 	default:
> 		goto not_supported;
> 	}
>-- 
>2.30.2
>
>
>From 627868f7bd64b1685fa22f165711d127896fd60a Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Fri, 6 Aug 2021 10:54:31 -0700
>Subject: [PATCH 5/6] s4: torture: Add test for smb2.ioctl.bug14769.
>
>Add knownfails.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14769
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit 7e7ea761a37f46f758582981bc40404ffd815513)
>---
> selftest/knownfail                       |  1 +
> selftest/knownfail.d/smb2_ioctl_bug14769 |  3 +
> source4/torture/smb2/ioctl.c             | 80 ++++++++++++++++++++++++
> 3 files changed, 84 insertions(+)
> create mode 100644 selftest/knownfail.d/smb2_ioctl_bug14769
>
>diff --git a/selftest/knownfail b/selftest/knownfail
>index b2c09e73393..9f362c02b47 100644
>--- a/selftest/knownfail
>+++ b/selftest/knownfail
>@@ -198,6 +198,7 @@
> ^samba4.smb2.ioctl.req_two_resume_keys\(ad_dc_ntvfs\) # not supported by s4 ntvfs server
> ^samba4.smb2.ioctl.copy_chunk_\w*\(ad_dc_ntvfs\)	# not supported by s4 ntvfs server
> ^samba4.smb2.ioctl.copy-chunk streams\(ad_dc_ntvfs\) # not supported by s4 ntvfs server
>+^samba4.smb2.ioctl.bug14769\(ad_dc_ntvfs\) # not supported by s4 ntvfs server
> ^samba3.smb2.dir.one
> ^samba3.smb2.dir.modify
> ^samba3.smb2.oplock.batch20
>diff --git a/selftest/knownfail.d/smb2_ioctl_bug14769 b/selftest/knownfail.d/smb2_ioctl_bug14769
>new file mode 100644
>index 00000000000..783a863cc06
>--- /dev/null
>+++ b/selftest/knownfail.d/smb2_ioctl_bug14769
>@@ -0,0 +1,3 @@
>+^samba3.smb2.ioctl fs_specific.bug14769\(nt4_dc\)
>+^samba3.smb2.ioctl.bug14769\(nt4_dc\)
>+^samba3.smb2.ioctl.bug14769\(ad_dc\)
>diff --git a/source4/torture/smb2/ioctl.c b/source4/torture/smb2/ioctl.c
>index 1de5179e336..022ea001688 100644
>--- a/source4/torture/smb2/ioctl.c
>+++ b/source4/torture/smb2/ioctl.c
>@@ -6845,6 +6845,84 @@ static bool test_ioctl_bug14607(struct torture_context *torture,
> 	return true;
> }
> 
>+/*
>+   basic regression test for BUG 14769
>+   https://bugzilla.samba.org/show_bug.cgi?id=14769
>+*/
>+static bool test_ioctl_bug14769(struct torture_context *torture,
>+				struct smb2_tree *tree)
>+{
>+	NTSTATUS status;
>+	const char *fname = "bug14769";
>+	bool ret = false;
>+	struct smb2_handle h;
>+	struct smb2_ioctl ioctl;
>+	struct smb2_close cl;
>+	struct smb2_request *smb2arr[2] = { 0 };
>+	uint8_t tosend_msec = 200;
>+	DATA_BLOB send_buf = { &tosend_msec, 1 };
>+
>+	/* Create a test file. */
>+	smb2_util_unlink(tree, fname);
>+	status = torture_smb2_testfile(tree, fname, &h);
>+	torture_assert_ntstatus_ok(torture, status, "create bug14769");
>+
>+	/*
>+	 * Send (not receive) the FSCTL.
>+	 * This should go async with a wait time of 200 msec.
>+	 */
>+	ZERO_STRUCT(ioctl);
>+	ioctl.in.file.handle = h;
>+	ioctl.in.function = FSCTL_SMBTORTURE_FSP_ASYNC_SLEEP;
>+	ioctl.in.flags = SMB2_IOCTL_FLAG_IS_FSCTL;
>+	ioctl.in.out = send_buf;
>+
>+	smb2arr[0] = smb2_ioctl_send(tree, &ioctl);
>+	torture_assert_goto(torture,
>+			    smb2arr[0] != NULL,
>+			    ret,
>+			    done,
>+			    "smb2_ioctl_send failed\n");
>+	/* Immediately send the close. */
>+	ZERO_STRUCT(cl);
>+	cl.in.file.handle = h;
>+	cl.in.flags = 0;
>+	smb2arr[1] = smb2_close_send(tree, &cl);
>+	torture_assert_goto(torture,
>+			    smb2arr[1] != NULL,
>+			    ret,
>+			    done,
>+			    "smb2_close_send failed\n");
>+
>+	/* Now get the FSCTL reply. */
>+	/*
>+	 * If we suffer from bug #14769 this will fail as
>+	 * the ioctl will return with NT_STATUS_FILE_CLOSED,
>+	 * as the close will have closed the handle without
>+	 * waiting for the ioctl to complete. The server shouldn't
>+	 * complete the close until the ioctl finishes.
>+	 */
>+	status = smb2_ioctl_recv(smb2arr[0], tree, &ioctl);
>+	torture_assert_ntstatus_ok_goto(torture,
>+					status,
>+					ret,
>+					done,
>+					"smb2_ioctl_recv failed\n");
>+
>+	/* Followed by the close reply. */
>+	status = smb2_close_recv(smb2arr[1], &cl);
>+	torture_assert_ntstatus_ok_goto(torture,
>+					status,
>+					ret,
>+					done,
>+					"smb2_ioctl_close failed\n");
>+	ret = true;
>+
>+  done:
>+	smb2_util_unlink(tree, fname);
>+	return ret;
>+}
>+
> /*
>  * testing of SMB2 ioctls
>  */
>@@ -6992,6 +7070,8 @@ struct torture_suite *torture_smb2_ioctl_init(TALLOC_CTX *ctx)
> 				     test_ioctl_dup_extents_dest_lck);
> 	torture_suite_add_1smb2_test(suite, "bug14607",
> 				     test_ioctl_bug14607);
>+	torture_suite_add_1smb2_test(suite, "bug14769",
>+				     test_ioctl_bug14769);
> 
> 	suite->description = talloc_strdup(suite, "SMB2-IOCTL tests");
> 
>-- 
>2.30.2
>
>
>From 584936a4bd289930aab37d85aa22b69121ba00d9 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Fri, 6 Aug 2021 23:33:06 -0700
>Subject: [PATCH 6/6] s3: smbd: For FSCTL calls that go async, add the
> outstanding tevent_reqs to the aio list on the file handle.
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Remove knownfails.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14769
>RN: smbd panic on force-close share during offload write
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>
>Autobuild-User(master): Ralph BÃ¶hme <slow@samba.org>
>Autobuild-Date(master): Wed Aug 11 20:02:57 UTC 2021 on sn-devel-184
>
>(cherry picked from commit c013509680742ff45b2f5965a5564015da7d466b)
>---
> selftest/knownfail.d/smb2_ioctl_bug14769 |  3 ---
> source3/smbd/smb2_ioctl.c                | 15 +++++++++++++++
> 2 files changed, 15 insertions(+), 3 deletions(-)
> delete mode 100644 selftest/knownfail.d/smb2_ioctl_bug14769
>
>diff --git a/selftest/knownfail.d/smb2_ioctl_bug14769 b/selftest/knownfail.d/smb2_ioctl_bug14769
>deleted file mode 100644
>index 783a863cc06..00000000000
>--- a/selftest/knownfail.d/smb2_ioctl_bug14769
>+++ /dev/null
>@@ -1,3 +0,0 @@
>-^samba3.smb2.ioctl fs_specific.bug14769\(nt4_dc\)
>-^samba3.smb2.ioctl.bug14769\(nt4_dc\)
>-^samba3.smb2.ioctl.bug14769\(ad_dc\)
>diff --git a/source3/smbd/smb2_ioctl.c b/source3/smbd/smb2_ioctl.c
>index 8154d3d8bfa..136f9baeda3 100644
>--- a/source3/smbd/smb2_ioctl.c
>+++ b/source3/smbd/smb2_ioctl.c
>@@ -230,6 +230,21 @@ NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
> 	if (subreq == NULL) {
> 		return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
> 	}
>+
>+	/*
>+	 * If the FSCTL has gone async on a file handle, remember
>+	 * to add it to the list of async requests we need to wait
>+	 * for on file handle close.
>+	 */
>+	if (in_fsp != NULL && tevent_req_is_in_progress(subreq)) {
>+		bool ok;
>+
>+		ok = aio_add_req_to_fsp(in_fsp, subreq);
>+		if (!ok) {
>+			return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
>+		}
>+	}
>+
> 	tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req);
> 
> 	return smbd_smb2_request_pending_queue(req, subreq, 1000);
>-- 
>2.30.2
>

Flags:

slow: review+

Actions: View

Attachments on bug 14769: 16701 | 16712 | 16716 | 16719 | 16720 | 16729 | 16730