In the _spoolss_DeletePrinterDriverEx() code path, the printer driver file names are pulled from the registry via a call to winreg_get_driver(). If the client issued the DeletePrinterDriverEx request with PD_DELETE_ALL_FILES or DPD_DELETE_UNUSED_FILES flags, then delete_driver_files() is called in an attempt to remove files associated with the driver. delete_driver_files() incorrectly assumes a print$ server path prefix for all driver file paths. 1500 bool delete_driver_files(const struct auth_session_info *session_info, 1501 const struct spoolss_DriverInfo8 *r) 1502 { ... 1557 /* now delete the files; must strip the '\print$' string from 1558 fron of path */ 1559 1560 if (r->driver_path && r->driver_path[0]) { 1561 if ((s = strchr(&r->driver_path[1], '\\')) != NULL) { 1562 file = s; 1563 DEBUG(10,("deleting driverfile [%s]\n", s)); 1564 driver_unlink_internals(conn, file); 1565 } 1566 } ... Driver file paths stored in the registry do not include the server path prefix.
This patch set includes fixes for this bug as well as bug#4942, before pushing upstream I'd like to add a torture test for multi-version printer driver deletion and also understand exactly what is causing strange the talloc_tos() behaviour. Nevertheless, a review of changes so far would be appreciated. http://git.samba.org/?p=ddiss/samba.git;a=shortlog;h=refs/heads/bso8697_fix_del_driver_wip The following changes since commit a325e7b560502ce43c78a7c6c8d692e872f262ae: s3: Fix bug 8695 (2012-01-17 18:55:01 +0100) are available in the git repository at: git://git.samba.org/ddiss/samba.git bso8697_fix_del_driver_wip David Disseldorp (9): s3-spoolss: prefix print$ path on driver file deletion s3-spoolss: fix printer driver version deletion s3-spoolss: fix werr on deletion of non-existent driver torture: add spoolss del printer driver test s3-spoolss: avoid freeing talloc_tos() context torture: test DeletePrinterDriverEx using modern arch and version torture: confirm printer driver file removal s3-spoolss: fix printer_driver_files_in_use() call ordering torture: add spoolss overlapping driver deletion tests source3/printing/nt_printing.c | 87 ++++----- source3/rpc_server/spoolss/srv_spoolss_nt.c | 276 +++++++++++---------------- source4/torture/rpc/spoolss.c | 258 +++++++++++++++++++++++++ 3 files changed, 410 insertions(+), 211 deletions(-)
(In reply to comment #1) > This patch set includes fixes for this bug as well as bug#4942, before pushing > upstream I'd like to add a torture test for multi-version printer driver > deletion and also understand exactly what is causing strange the talloc_tos() > behaviour. The "strange talloc_tos() behaviour" mentioned was my own misunderstanding of how talloc_tos() works. New round of patches rebased, squashed and cleaned up: http://git.samba.org/?p=ddiss/samba.git;a=shortlog;h=refs/heads/bso8697_fix_del_driver_rb1 ddiss@plati:~/isms/samba> git request-pull origin/master git://git.samba.org/ddiss/samba.git The following changes since commit 957ec2813934428331e5e23527566afaee8fa5f4: s3: Fix a typo (2012-01-19 13:43:07 +0100) are available in the git repository at: git://git.samba.org/ddiss/samba.git bso8697_fix_del_driver_rb1 David Disseldorp (6): s3-spoolss: prefix print$ path on driver file deletion s3-spoolss: fix printer driver version deletion torture: add spoolss del printer driver test torture: confirm printer driver file removal s3-spoolss: fix printer_driver_files_in_use() call ordering torture: add spoolss overlapping driver deletion tests source3/printing/nt_printing.c | 81 ++++----- source3/rpc_server/spoolss/srv_spoolss_nt.c | 276 +++++++++++---------------- source4/torture/rpc/spoolss.c | 260 +++++++++++++++++++++++++ 3 files changed, 408 insertions(+), 209 deletions(-)
Back-port for v3-6-test, a few minor differences from the master version: - messaging context and session info passed to winreg based helper fns - pipes_struct->mem_ctx talloc context used - "fix DPD_DELETE_ALL_FILES error return" also picked from master http://git.samba.org/?p=ddiss/samba.git;a=shortlog;h=refs/heads/bso8697_fix_del_driver_rb2_36t The following changes since commit 3ea8d8acaefaadd2d3888bec1ef148b7242aaccf: WHATSNEW: Start release notes for 3.6.2. (2012-01-21 22:17:42 +0100) are available in the git repository at: git://git.samba.org/ddiss/samba.git bso8697_fix_del_driver_rb2_36t David Disseldorp (7): spoolss: fix DPD_DELETE_ALL_FILES error return s3-spoolss: prefix print$ path on driver file deletion s3-spoolss: fix printer driver version deletion s3-spoolss: fix printer_driver_files_in_use() call ordering torture: add spoolss del printer driver test torture: confirm printer driver file removal torture: add spoolss overlapping driver deletion tests source3/printing/nt_printing.c | 81 ++++---- source3/rpc_server/spoolss/srv_spoolss_nt.c | 304 ++++++++++++--------------- source4/torture/rpc/spoolss.c | 260 +++++++++++++++++++++++ 3 files changed, 427 insertions(+), 218 deletions(-)
Created attachment 7250 [details] backport of same changes for 3.6-test
Hi Karolin, please pull the attached patch for 3.6.x. The changes cover this bug as well as bso#4942.
Pushed to v3-6-test. Closing out bug report. Thanks!