Bug 10426 - smbd crashed when setting windows acl
smbd crashed when setting windows acl
Status: NEW
Product: Samba 3.6
Classification: Unclassified
Component: File services
3.6.16
x64 Linux
: P5 normal
: ---
Assigned To: Volker Lendecke
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2014-02-07 01:29 UTC by yanhuan
Modified: 2014-02-07 01:30 UTC (History)
0 users

See Also:


Attachments
level 10 log.smbd (200.19 KB, application/octet-stream)
2014-02-07 01:30 UTC, yanhuan
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description yanhuan 2014-02-07 01:29:27 UTC
Hi:
My smbd crashed when setting windows acl, my samba version is 3.6.16, here is a small piece of log.smbd:

[2014/01/23 10:24:06.204184, 10] smbd/posix_acls.c:848(print_canon_ace_list)
print_canon_ace_list: file ace - before deny
canon_ace index 0. Type = deny SID = S-1-5-7 gid 16777223 (16777223) SMB_ACL_GROUP ace_flags = 0x0 perms rwx
canon_ace index 1. Type = deny SID = S-1-1-0 other SMB_ACL_OTHER ace_flags = 0x0 perms rwx
*** glibc detected *** smbd: malloc(): memory corruption: 0x00002b0acaeb21c0 ***

The program went to the codes posix_acls.c:process_deny_list below:
if (curr_ace->perms == ALL_ACE_PERMS) {

/*
* Optimisation. This is a DENY_ALL to Everyone. Truncate the
* list at this point including this entry.
*/

canon_ace *prev_entry = DLIST_PREV(curr_ace);

free_canon_ace_list( curr_ace );
if (prev_entry)
DLIST_REMOVE(ace_list, prev_entry);
else {
/* We deleted the entire list. */
ace_list = NULL;
}
break;
}

I think we should set prev_entry->next = NULL and ace_list->prev = curr_ace->prev before calling free_canon_ace_list.
But I want more, as this is a DENY_ALL to everyone, it would be OK to remove the entire list. I rewrite the codes below:
free_canon_ace_list(ace_list);
ace_list = NULL;
break;
Please let me know if I am right. Thank you.

P.S.
I enabled windows acl with parameters below:
vfs objects=acl_xattr 
map acl inherit=yes 
inherit acls=yes 
store dos attributes=yes
dos filemode=yes
ea support=yes
Comment 1 yanhuan 2014-02-07 01:30:45 UTC
Created attachment 9650 [details]
level 10 log.smbd