The Samba-Bugzilla – Attachment 16957 Details for
Bug 14882
smbXsrv_client_global record validation leads to crash if existing record points at non-existing process
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
git-am fix for 4.15.next.
bug-14882-4.15.patch (text/plain), 7.57 KB, created by
Jeremy Allison
on 2021-11-04 20:19:46 UTC
(
hide
)
Description:
git-am fix for 4.15.next.
Filename:
MIME Type:
Creator:
Jeremy Allison
Created:
2021-11-04 20:19:46 UTC
Size:
7.57 KB
patch
obsolete
>From 8f7610cfb692d4d61231a4499e5c07b977a4a425 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Mon, 5 Oct 2020 08:52:32 +0200 >Subject: [PATCH 1/3] s3/libsmb: check for global parametric option > "libsmb:client_guid" > >Useful in test. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14882 > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Ralph Boehme <slow@samba.org> >(cherry picked from commit c1470b120bb75ea73ba90dc83ab7efcbb733b1a7) >--- > source3/libsmb/clientgen.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > >diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c >index b9b2bacaa76..6819e532349 100644 >--- a/source3/libsmb/clientgen.c >+++ b/source3/libsmb/clientgen.c >@@ -79,7 +79,14 @@ struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx, > if (!GUID_all_zero(&cli_state_client_guid)) { > client_guid = cli_state_client_guid; > } else { >- client_guid = GUID_random(); >+ const char *str = NULL; >+ >+ str = lp_parm_const_string(-1, "libsmb", "client_guid", NULL); >+ if (str != NULL) { >+ GUID_from_string(str, &client_guid); >+ } else { >+ client_guid = GUID_random(); >+ } > } > > /* Check the effective uid - make sure we are not setuid */ >-- >2.30.2 > > >From a413b53d57fd8898c0d60a9618017eedd302b0c8 Mon Sep 17 00:00:00 2001 >From: Ralph Boehme <slow@samba.org> >Date: Fri, 29 Oct 2021 06:27:38 +0200 >Subject: [PATCH 2/3] CI: add a test for bug 14882 > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14882 > >Signed-off-by: Ralph Boehme <slow@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> >(cherry picked from commit 1fa006f1f71cce03d92e76efda3ff055aae4eb91) >--- > .../samba3.blackbox.smbXsrv_client_dead_rec | 1 + > .../tests/test_smbXsrv_client_dead_rec.sh | 76 +++++++++++++++++++ > source3/selftest/tests.py | 7 ++ > 3 files changed, 84 insertions(+) > create mode 100644 selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec > create mode 100755 source3/script/tests/test_smbXsrv_client_dead_rec.sh > >diff --git a/selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec b/selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec >new file mode 100644 >index 00000000000..16f8446dcf9 >--- /dev/null >+++ b/selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec >@@ -0,0 +1 @@ >+^samba3.blackbox.smbXsrv_client_dead_rec.check_panic\(fileserver:local\) >diff --git a/source3/script/tests/test_smbXsrv_client_dead_rec.sh b/source3/script/tests/test_smbXsrv_client_dead_rec.sh >new file mode 100755 >index 00000000000..0ed10e78a7a >--- /dev/null >+++ b/source3/script/tests/test_smbXsrv_client_dead_rec.sh >@@ -0,0 +1,76 @@ >+#!/bin/bash >+# >+# Test smbd doesn't crash if there an existing dead record for a client with a >+# specific client-guid in smbXsrv_client_global.tdb >+# >+ >+if [ $# -lt 2 ]; then >+ echo Usage: test_smbXsrv_client_dead_rec.sh SERVERCONFFILE IP SHARENAME >+ exit 1 >+fi >+ >+CONF=$1 >+SERVER=$2 >+SHARE=$3 >+ >+SMBCLIENT="$BINDIR/smbclient" >+SMBSTATUS="$BINDIR/smbstatus" >+ >+SMBD_LOG_FILE="$SMBD_TEST_LOG" >+if [ -n "$SMBD_DONT_LOG_STDOUT" ]; then >+ SMBD_LOG_FILE=$(dirname "$SMBD_TEST_LOG")/logs/log.smbd >+fi >+SMBD_LOG_FILE=$(realpath "$SMBD_LOG_FILE") >+ >+incdir=$(dirname "$0")/../../../testprogs/blackbox >+. "$incdir"/subunit.sh >+ >+failed=0 >+ >+cd "$SELFTEST_TMPDIR" || exit 1 >+ >+# >+# Note if we already have any panics in the smbd log. >+# >+panic_count_0=$(grep -c PANIC "$SMBD_LOG_FILE") >+ >+# Create the smbclient communication pipes. >+rm -f smbclient-stdin smbclient-stdout smbclient-stderr >+mkfifo smbclient-stdin smbclient-stdout smbclient-stderr >+ >+CLI_FORCE_INTERACTIVE=1; export CLI_FORCE_INTERACTIVE >+ >+# Connect a first time >+${SMBCLIENT} //"${SERVER}"/"${SHARE}" -U"${USER}"%"${PASSWORD}" \ >+ --option="libsmb:client_guid=6112f7d3-9528-4a2a-8861-0ca129aae6c4" \ >+ < smbclient-stdin > smbclient-stdout 2>smbclient-stderr & >+CLIENT_PID=$! >+ >+exec 100>smbclient-stdin 101<smbclient-stdout 102<smbclient-stderr >+ >+export UID_WRAPPER_ROOT=1 >+SMBD_PID=$(UID_WRAPPER_INITIAL_RUID=0 UID_WRAPPER_INITIAL_EUID=0 "$SMBSTATUS" -p "$CONF" | awk '/^[0-9]+/ {print $1}' | sort -u) >+ >+# Kill the first connection, leaves dead record in smbXsrv_client_global.tdb >+kill -KILL "$SMBD_PID" >+kill $CLIENT_PID >+ >+# Connect a second time >+unset CLI_FORCE_INTERACTIVE >+${SMBCLIENT} //"${SERVER}"/"${SHARE}" -U"${USER}"%"${PASSWORD}" \ >+ --option="libsmb:client_guid=6112f7d3-9528-4a2a-8861-0ca129aae6c4" \ >+ -c exit >+ >+rm -f smbclient-stdin smbclient-stdout aio_outstanding_testfile >+ >+# >+# Ensure the panic count didn't change. >+# >+# BUG: https://bugzilla.samba.org/show_bug.cgi?id=14882 >+# >+panic_count_1=$(grep -c PANIC "$SMBD_LOG_FILE") >+ >+testit "check_panic" test "$panic_count_0" -eq "$panic_count_1" || >+ failed=$(expr $failed + 1) >+ >+testok "$0" "$failed" >diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py >index 60b3f18eded..10dd5042e46 100755 >--- a/source3/selftest/tests.py >+++ b/source3/selftest/tests.py >@@ -1193,6 +1193,13 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver", > "$USERNAME", "$PASSWORD", "$SERVER", > smbclient3]) > >+plantestsuite("samba3.blackbox.smbXsrv_client_dead_rec", "fileserver:local", >+ [os.path.join(samba3srcdir, >+ "script/tests/test_smbXsrv_client_dead_rec.sh"), >+ configuration, >+ '$SERVER_IP', >+ "tmp"]) >+ > for env in ['fileserver', 'simpleserver']: > plantestsuite("samba3.blackbox.smbclient.encryption", env, > [os.path.join(samba3srcdir, "script/tests/test_smbclient_encryption.sh"), >-- >2.30.2 > > >From 1611239802e73f40ee4025f79fa779d7943c5ceb Mon Sep 17 00:00:00 2001 >From: Ralph Boehme <slow@samba.org> >Date: Fri, 29 Oct 2021 22:03:42 +0200 >Subject: [PATCH 3/3] lib/dbwrap: reset deleted record to tdb_null > >This allows the calling the following sequence of dbwrap functions: > > dbwrap_delete_record(rec); > data = dbwrap_record_get_value(rec); > >without triggering the assert rec->value_valid inside dbwrap_record_get_value(). > >Note that dbwrap_record_storev() continues to invalidate the record, so this >change somewhat blurs our semantics. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14882 > >Signed-off-by: Ralph Boehme <slow@samba.org> >Reviewed-by: Volker Lendecke <vl@samba.org> > >Autobuild-User(master): Jeremy Allison <jra@samba.org> >Autobuild-Date(master): Thu Nov 4 19:49:47 UTC 2021 on sn-devel-184 > >(cherry picked from commit 8082e2eb7e33c0993135791c03823886f5aa8496) >--- > lib/dbwrap/dbwrap.c | 9 +++------ > .../knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec | 1 - > 2 files changed, 3 insertions(+), 7 deletions(-) > delete mode 100644 selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec > >diff --git a/lib/dbwrap/dbwrap.c b/lib/dbwrap/dbwrap.c >index cc685a2fa69..7555efaa3ab 100644 >--- a/lib/dbwrap/dbwrap.c >+++ b/lib/dbwrap/dbwrap.c >@@ -110,16 +110,13 @@ NTSTATUS dbwrap_record_delete(struct db_record *rec) > { > NTSTATUS status; > >- /* >- * Invalidate before rec->delete_rec() is called, give >- * rec->delete_rec() the chance to re-validate rec->value. >- */ >- rec->value_valid = false; >- > status = rec->delete_rec(rec); > if (!NT_STATUS_IS_OK(status)) { > return status; > } >+ >+ rec->value = tdb_null; >+ > return NT_STATUS_OK; > } > >diff --git a/selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec b/selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec >deleted file mode 100644 >index 16f8446dcf9..00000000000 >--- a/selftest/knownfail.d/samba3.blackbox.smbXsrv_client_dead_rec >+++ /dev/null >@@ -1 +0,0 @@ >-^samba3.blackbox.smbXsrv_client_dead_rec.check_panic\(fileserver:local\) >-- >2.30.2 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
slow
:
review+
Actions:
View
Attachments on
bug 14882
: 16957