s3:smb2_server: make the logic of SMB2_CANCEL DLIST_REMOVE() clearer

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11581

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index 2692fb8d112db920fcaf888c1dd07c605e148525..cdcead0dbce99bec476f2e16f95ce52453321687 100644 (file)
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -1705,6 +1705,14 @@ static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
        search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
        search_async_id = BVAL(inhdr, SMB2_HDR_PID);
 
+       /*
+        * We don't need the request anymore cancel requests never
+        * have a response.
+        *
+        * We defer the TALLOC_FREE(req) to the caller.
+        */
+       DLIST_REMOVE(xconn->smb2.requests, req);
+
        for (cur = xconn->smb2.requests; cur; cur = cur->next) {
                const uint8_t *outhdr;
                uint64_t message_id;
@@ -2365,8 +2373,10 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
                /*
                 * We don't need the request anymore cancel requests never
                 * have a response.
+                *
+                * smbd_smb2_request_process_cancel() already called
+                * DLIST_REMOVE(xconn->smb2.requests, req);
                 */
-               DLIST_REMOVE(xconn->smb2.requests, req);
                TALLOC_FREE(req);
 
                break;