Bug 12832 - Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try
Summary: Crash in the reentrant smbd_smb2_create_send() if the something fails in the ...
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: 4.6.5
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-09 11:04 UTC by Stefan Metzmacher
Modified: 2017-07-03 08:59 UTC (History)
5 users (show)

See Also:

Attachments
Possible patch for master (needs regression tests) (2.62 KB, patch)
2017-06-09 11:08 UTC, Stefan Metzmacher 		no flags Details
Additional patch (1.13 KB, text/plain)
2017-06-09 14:51 UTC, Volker Lendecke 		no flags Details
Patch for v4-6-test (3.32 KB, patch)
2017-06-29 13:59 UTC, Stefan Metzmacher 		slow: review+
Details
Patch for v4-5-test (3.32 KB, patch)
2017-06-29 14:00 UTC, Stefan Metzmacher 		slow: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Metzmacher 2017-06-09 11:04:24 UTC 
As the caller ("smbd_smb2_request_process_create()") already sets the callback, the first time, it's not safe to reuse the tevent_req structure.

The typicall 'tevent_req_nterror(); return tevent_req_post()' will
crash as the tevent_req_nterror() already triggered the former callback,
which calls smbd_smb2_create_recv(), were tevent_req_received() invalidates
the tevent_req structure, so that tevent_req_post() will crash.

There's actually no need to (re-)use the old structure at all.
Comment 1 Stefan Metzmacher 2017-06-09 11:08:36 UTC 
Created attachment 13266 [details]
Possible patch for master (needs regression tests)
Comment 2 Volker Lendecke 2017-06-09 14:51:02 UTC 
Created attachment 13267 [details]
Additional patch

Review via bugzilla... Additional one for metze :-)
Comment 3 Volker Lendecke 2017-06-09 18:56:30 UTC 
Just FYI: Those two patches just survived a private autobuild.
Comment 4 Stefan Metzmacher 2017-06-12 07:44:36 UTC 
(In reply to Volker Lendecke from comment #3)

Thanks! I think we should squash the two commits and adjust
the commit message...
Comment 5 Stefan Metzmacher 2017-06-29 13:59:47 UTC 
Created attachment 13333 [details]
Patch for v4-6-test
Comment 6 Stefan Metzmacher 2017-06-29 14:00:17 UTC 
Created attachment 13334 [details]
Patch for v4-5-test
Comment 7 Ralph Böhme 2017-06-29 14:13:22 UTC 
Reassigning to Karolin for inclusion in 4.5 and 4.6.
Comment 8 Karolin Seeger 2017-06-30 08:45:43 UTC 
(In reply to Ralph Böhme from comment #7)
Pushed to autobuild-v4-{6,5}-test.
Comment 9 Karolin Seeger 2017-07-03 08:59:11 UTC 
(In reply to Karolin Seeger from comment #8)
Pushed to both branches.
Closing out bug report.

Thanks!