Bug 12832 - Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try
Summary: Crash in the reentrant smbd_smb2_create_send() if the something fails in the ...
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: 4.6.5
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-09 11:04 UTC by Stefan Metzmacher
Modified: 2017-07-03 08:59 UTC (History)
5 users (show)

See Also:


Attachments
Possible patch for master (needs regression tests) (2.62 KB, patch)
2017-06-09 11:08 UTC, Stefan Metzmacher
no flags Details
Additional patch (1.13 KB, text/plain)
2017-06-09 14:51 UTC, Volker Lendecke
no flags Details
Patch for v4-6-test (3.32 KB, patch)
2017-06-29 13:59 UTC, Stefan Metzmacher
slow: review+
Details
Patch for v4-5-test (3.32 KB, patch)
2017-06-29 14:00 UTC, Stefan Metzmacher
slow: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Metzmacher 2017-06-09 11:04:24 UTC
As the caller ("smbd_smb2_request_process_create()") already sets the callback, the first time, it's not safe to reuse the tevent_req structure.

The typicall 'tevent_req_nterror(); return tevent_req_post()' will
crash as the tevent_req_nterror() already triggered the former callback,
which calls smbd_smb2_create_recv(), were tevent_req_received() invalidates
the tevent_req structure, so that tevent_req_post() will crash.

There's actually no need to (re-)use the old structure at all.
Comment 1 Stefan Metzmacher 2017-06-09 11:08:36 UTC
Created attachment 13266 [details]
Possible patch for master (needs regression tests)
Comment 2 Volker Lendecke 2017-06-09 14:51:02 UTC
Created attachment 13267 [details]
Additional patch

Review via bugzilla... Additional one for metze :-)
Comment 3 Volker Lendecke 2017-06-09 18:56:30 UTC
Just FYI: Those two patches just survived a private autobuild.
Comment 4 Stefan Metzmacher 2017-06-12 07:44:36 UTC
(In reply to Volker Lendecke from comment #3)

Thanks! I think we should squash the two commits and adjust
the commit message...
Comment 5 Stefan Metzmacher 2017-06-29 13:59:47 UTC
Created attachment 13333 [details]
Patch for v4-6-test
Comment 6 Stefan Metzmacher 2017-06-29 14:00:17 UTC
Created attachment 13334 [details]
Patch for v4-5-test
Comment 7 Ralph Böhme 2017-06-29 14:13:22 UTC
Reassigning to Karolin for inclusion in 4.5 and 4.6.
Comment 8 Karolin Seeger 2017-06-30 08:45:43 UTC
(In reply to Ralph Böhme from comment #7)
Pushed to autobuild-v4-{6,5}-test.
Comment 9 Karolin Seeger 2017-07-03 08:59:11 UTC
(In reply to Karolin Seeger from comment #8)
Pushed to both branches.
Closing out bug report.

Thanks!