Remove cancel_aio_by_fsp(). It can never work and could lead to memory corruption

as outstanding IO's complete. Also we never have any aio's on a call to close_normal_file()
with close_type ERROR_CLOSE.

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index 8050e9949807a5d888449c617bca5b0aa1b78a7e..5e2d2b3dfe7027321569feb626a4e77ae3bd7345 100644 (file)
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -911,12 +911,12 @@ void smbd_aio_complete_aio_ex(struct aio_extra *aio_ex)
 }
 
 /****************************************************************************
- We're doing write behind and the client closed the file. Wait up to 30
+ We're doing write behind and the client closed the file. Wait up to 45
  seconds (my arbitrary choice) for the aio to complete. Return 0 if all writes
  completed, errno to return if not.
 *****************************************************************************/
 
-#define SMB_TIME_FOR_AIO_COMPLETE_WAIT 29
+#define SMB_TIME_FOR_AIO_COMPLETE_WAIT 45
 
 int wait_for_aio_completion(files_struct *fsp)
 {
@@ -980,8 +980,14 @@ int wait_for_aio_completion(files_struct *fsp)
                                 "%d seconds\n", aio_completion_count,
                                 seconds_left));
                        /* Timeout. */
-                       cancel_aio_by_fsp(fsp);
                        SAFE_FREE(aiocb_list);
+                       /* We're hosed here - IO may complete
+                          and trample over memory if we free
+                          the aio_ex struct, but if we don't
+                          we leak IO requests. I think smb_panic()
+                          if the right thing to do here. JRA.
+                       */
+                       smb_panic("AIO suspend timed out - cannot continue.");
                        return EIO;
                }
 
@@ -1010,29 +1016,6 @@ int wait_for_aio_completion(files_struct *fsp)
        return EIO;
 }
 
-/****************************************************************************
- Cancel any outstanding aio requests. The client doesn't care about the reply.
-*****************************************************************************/
-
-void cancel_aio_by_fsp(files_struct *fsp)
-{
-       struct aio_extra *aio_ex;
-
-       for( aio_ex = aio_list_head; aio_ex; aio_ex = aio_ex->next) {
-               if (aio_ex->fsp == fsp) {
-                       /* Unlock now we're done. */
-                       SMB_VFS_STRICT_UNLOCK(fsp->conn, fsp, &aio_ex->lock);
-
-                       /* Don't delete the aio_extra record as we may have
-                          completed and don't yet know it. Just do the
-                          aio_cancel call and return. */
-                       SMB_VFS_AIO_CANCEL(fsp, &aio_ex->acb);
-                       aio_ex->fsp = NULL; /* fsp will be closed when we
-                                            * return. */
-               }
-       }
-}
-
 #else
 
 bool initialize_async_io_handler(void)
@@ -1083,10 +1066,6 @@ NTSTATUS schedule_aio_smb2_write(connection_struct *conn,
        return NT_STATUS_RETRY;
 }
 
-void cancel_aio_by_fsp(files_struct *fsp)
-{
-}
-
 int wait_for_aio_completion(files_struct *fsp)
 {
        return 0;

diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index dc6df47ee657ab6371d7f82c622e9124c84e539b..c87b1a000be41b4d022d6732390147e46e2182b6 100644 (file)
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -667,19 +667,16 @@ static NTSTATUS close_normal_file(struct smb_request *req, files_struct *fsp,
        NTSTATUS status = NT_STATUS_OK;
        NTSTATUS tmp;
        connection_struct *conn = fsp->conn;
+       int ret;
 
-       if (close_type == ERROR_CLOSE) {
-               cancel_aio_by_fsp(fsp);
-       } else {
-               /*
-                * If we're finishing async io on a close we can get a write
-                * error here, we must remember this.
-                */
-               int ret = wait_for_aio_completion(fsp);
-               if (ret) {
-                       status = ntstatus_keeperror(
-                               status, map_nt_error_from_unix(ret));
-               }
+       /*
+        * If we're finishing async io on a close we can get a write
+        * error here, we must remember this.
+        */
+       ret = wait_for_aio_completion(fsp);
+       if (ret) {
+               status = ntstatus_keeperror(
+                       status, map_nt_error_from_unix(ret));
        }
 
        /*

diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index f2040cdbac57643d392f42119665dbb7ea30f067..a770c3a2a4d5030e78280c4029c00bd85fa8d55a 100644 (file)
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -89,7 +89,6 @@ NTSTATUS schedule_aio_smb2_write(connection_struct *conn,
                                bool write_through);
 bool cancel_smb2_aio(struct smb_request *smbreq);
 int wait_for_aio_completion(files_struct *fsp);
-void cancel_aio_by_fsp(files_struct *fsp);
 void smbd_aio_complete_aio_ex(struct aio_extra *aio_ex);
 
 /* The following definitions come from smbd/blocking.c  */