source3/smbd/blocking.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Blocking Locking functions
   4    Copyright (C) Jeremy Allison 1998-2003
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #undef DBGC_CLASS
  22 #define DBGC_CLASS DBGC_LOCKING
  23
  24 /****************************************************************************
  25  This is the structure to queue to implement blocking locks.
  26  notify. It consists of the requesting SMB and the expiry time.
  27 *****************************************************************************/
  28
  29 typedef struct blocking_lock_record {
  30         struct blocking_lock_record *next;
  31         struct blocking_lock_record *prev;
  32         files_struct *fsp;
  33         struct timeval expire_time;
  34         int lock_num;
  35         uint64_t offset;
  36         uint64_t count;
  37         uint32_t lock_pid;
  38         uint32_t blocking_pid; /* PID that blocks us. */
  39         enum brl_flavour lock_flav;
  40         enum brl_type lock_type;
  41         struct smb_request *req;
  42 } blocking_lock_record;
  43
  44 /* dlink list we store pending lock records on. */
  45 static blocking_lock_record *blocking_lock_queue;
  46
  47 /* dlink list we move cancelled lock records onto. */
  48 static blocking_lock_record *blocking_lock_cancelled_queue;
  49
  50 /* The event that makes us process our blocking lock queue */
  51 static struct timed_event *brl_timeout;
  52
  53 /****************************************************************************
  54  Determine if this is a secondary element of a chained SMB.
  55   **************************************************************************/
  56
  57 static bool in_chained_smb(void)
  58 {
  59         return (chain_size != 0);
  60 }
  61
  62 static void received_unlock_msg(struct messaging_context *msg,
  63                                 void *private_data,
  64                                 uint32_t msg_type,
  65                                 struct server_id server_id,
  66                                 DATA_BLOB *data);
  67 static void process_blocking_lock_queue(void);
  68
  69 static void brl_timeout_fn(struct event_context *event_ctx,
  70                            struct timed_event *te,
  71                            struct timeval now,
  72                            void *private_data)
  73 {
  74         SMB_ASSERT(brl_timeout == te);
  75         TALLOC_FREE(brl_timeout);
  76
  77         change_to_root_user();  /* TODO: Possibly run all timed events as
  78                                  * root */
  79
  80         process_blocking_lock_queue();
  81 }
  82
  83 /****************************************************************************
  84  After a change to blocking_lock_queue, recalculate the timed_event for the
  85  next processing.
  86 ****************************************************************************/
  87
  88 static bool recalc_brl_timeout(void)
  89 {
  90         blocking_lock_record *brl;
  91         struct timeval next_timeout;
  92
  93         TALLOC_FREE(brl_timeout);
  94
  95         next_timeout = timeval_zero();
  96
  97         for (brl = blocking_lock_queue; brl; brl = brl->next) {
  98                 if (timeval_is_zero(&brl->expire_time)) {
  99                         /*
 100                          * If we're blocked on pid 0xFFFFFFFF this is
 101                          * a POSIX lock, so calculate a timeout of
 102                          * 10 seconds into the future.
 103                          */
 104                         if (brl->blocking_pid == 0xFFFFFFFF) {
 105                                 struct timeval psx_to = timeval_current_ofs(10, 0);
 106                                 next_timeout = timeval_min(&next_timeout, &psx_to);
 107                         }
 108
 109                         continue;
 110                 }
 111
 112                 if (timeval_is_zero(&next_timeout)) {
 113                         next_timeout = brl->expire_time;
 114                 }
 115                 else {
 116                         next_timeout = timeval_min(&next_timeout,
 117                                                    &brl->expire_time);
 118                 }
 119         }
 120
 121         if (timeval_is_zero(&next_timeout)) {
 122                 return True;
 123         }
 124
 125         if (!(brl_timeout = event_add_timed(smbd_event_context(), NULL,
 126                                             next_timeout,
 127                                             brl_timeout_fn, NULL))) {
 128                 return False;
 129         }
 130
 131         return True;
 132 }
 133
 134
 135 /****************************************************************************
 136  Function to push a blocking lock request onto the lock queue.
 137 ****************************************************************************/
 138
 139 bool push_blocking_lock_request( struct byte_range_lock *br_lck,
 140                 struct smb_request *req,
 141                 files_struct *fsp,
 142                 int lock_timeout,
 143                 int lock_num,
 144                 uint32_t lock_pid,
 145                 enum brl_type lock_type,
 146                 enum brl_flavour lock_flav,
 147                 uint64_t offset,
 148                 uint64_t count,
 149                 uint32_t blocking_pid)
 150 {
 151         static bool set_lock_msg;
 152         blocking_lock_record *blr;
 153         NTSTATUS status;
 154
 155         if(in_chained_smb() ) {
 156                 DEBUG(0,("push_blocking_lock_request: cannot queue a chained request (currently).\n"));
 157                 return False;
 158         }
 159
 160         /*
 161          * Now queue an entry on the blocking lock queue. We setup
 162          * the expiration time here.
 163          */
 164
 165         blr = talloc(NULL, struct blocking_lock_record);
 166         if (blr == NULL) {
 167                 DEBUG(0,("push_blocking_lock_request: Malloc fail !\n" ));
 168                 return False;
 169         }
 170
 171         blr->next = NULL;
 172         blr->prev = NULL;
 173
 174         blr->fsp = fsp;
 175         if (lock_timeout == -1) {
 176                 blr->expire_time.tv_sec = 0;
 177                 blr->expire_time.tv_usec = 0; /* Never expire. */
 178         } else {
 179                 blr->expire_time = timeval_current_ofs(lock_timeout/1000,
 180                                         (lock_timeout % 1000) * 1000);
 181         }
 182         blr->lock_num = lock_num;
 183         blr->lock_pid = lock_pid;
 184         blr->blocking_pid = blocking_pid;
 185         blr->lock_flav = lock_flav;
 186         blr->lock_type = lock_type;
 187         blr->offset = offset;
 188         blr->count = count;
 189
 190         /* Add a pending lock record for this. */
 191         status = brl_lock(smbd_messaging_context(), br_lck,
 192                         lock_pid,
 193                         procid_self(),
 194                         offset,
 195                         count,
 196                         lock_type == READ_LOCK ? PENDING_READ_LOCK : PENDING_WRITE_LOCK,
 197                         blr->lock_flav,
 198                         lock_timeout ? True : False, /* blocking_lock. */
 199                         NULL);
 200
 201         if (!NT_STATUS_IS_OK(status)) {
 202                 DEBUG(0,("push_blocking_lock_request: failed to add PENDING_LOCK record.\n"));
 203                 DLIST_REMOVE(blocking_lock_queue, blr);
 204                 TALLOC_FREE(blr);
 205                 return False;
 206         }
 207
 208         blr->req = talloc_move(blr, &req);
 209
 210         DLIST_ADD_END(blocking_lock_queue, blr, blocking_lock_record *);
 211         recalc_brl_timeout();
 212
 213         /* Ensure we'll receive messages when this is unlocked. */
 214         if (!set_lock_msg) {
 215                 messaging_register(smbd_messaging_context(), NULL,
 216                                    MSG_SMB_UNLOCK, received_unlock_msg);
 217                 set_lock_msg = True;
 218         }
 219
 220         DEBUG(3,("push_blocking_lock_request: lock request blocked with "
 221                 "expiry time (%u sec. %u usec) (+%d msec) for fnum = %d, name = %s\n",
 222                 (unsigned int)blr->expire_time.tv_sec,
 223                 (unsigned int)blr->expire_time.tv_usec, lock_timeout,
 224                 blr->fsp->fnum, blr->fsp->fsp_name ));
 225
 226         /* Push the MID of this packet on the signing queue. */
 227         srv_defer_sign_response(blr->req->mid);
 228
 229         return True;
 230 }
 231
 232 /****************************************************************************
 233  Return a lockingX success SMB.
 234 *****************************************************************************/
 235
 236 static void reply_lockingX_success(blocking_lock_record *blr)
 237 {
 238         reply_outbuf(blr->req, 2, 0);
 239
 240         /*
 241          * As this message is a lockingX call we must handle
 242          * any following chained message correctly.
 243          * This is normally handled in construct_reply(),
 244          * but as that calls switch_message, we can't use
 245          * that here and must set up the chain info manually.
 246          */
 247
 248         chain_reply(blr->req);
 249
 250         if (!srv_send_smb(smbd_server_fd(), (char *)blr->req->outbuf,
 251                         IS_CONN_ENCRYPTED(blr->fsp->conn))) {
 252                 exit_server_cleanly("send_blocking_reply: srv_send_smb failed.");
 253         }
 254
 255         TALLOC_FREE(blr->req->outbuf);
 256 }
 257
 258 /****************************************************************************
 259  Return a generic lock fail error blocking call.
 260 *****************************************************************************/
 261
 262 static void generic_blocking_lock_error(blocking_lock_record *blr, NTSTATUS status)
 263 {
 264         /* whenever a timeout is given w2k maps LOCK_NOT_GRANTED to
 265            FILE_LOCK_CONFLICT! (tridge) */
 266         if (NT_STATUS_EQUAL(status, NT_STATUS_LOCK_NOT_GRANTED)) {
 267                 status = NT_STATUS_FILE_LOCK_CONFLICT;
 268         }
 269
 270         if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_LOCK_CONFLICT)) {
 271                 /* Store the last lock error. */
 272                 files_struct *fsp = blr->fsp;
 273
 274                 if (fsp) {
 275                         fsp->last_lock_failure.context.smbpid = blr->lock_pid;
 276                         fsp->last_lock_failure.context.tid = fsp->conn->cnum;
 277                         fsp->last_lock_failure.context.pid = procid_self();
 278                         fsp->last_lock_failure.start = blr->offset;
 279                         fsp->last_lock_failure.size = blr->count;
 280                         fsp->last_lock_failure.fnum = fsp->fnum;
 281                         fsp->last_lock_failure.lock_type = READ_LOCK; /* Don't care. */
 282                         fsp->last_lock_failure.lock_flav = blr->lock_flav;
 283                 }
 284         }
 285
 286         reply_nterror(blr->req, status);
 287         if (!srv_send_smb(smbd_server_fd(), (char *)blr->req->outbuf,
 288                           blr->req->encrypted)) {
 289                 exit_server_cleanly("generic_blocking_lock_error: srv_send_smb failed.");
 290         }
 291         TALLOC_FREE(blr->req->outbuf);
 292 }
 293
 294 /****************************************************************************
 295  Return a lock fail error for a lockingX call. Undo all the locks we have
 296  obtained first.
 297 *****************************************************************************/
 298
 299 static void reply_lockingX_error(blocking_lock_record *blr, NTSTATUS status)
 300 {
 301         files_struct *fsp = blr->fsp;
 302         uint16 num_ulocks = SVAL(blr->req->vwv+6, 0);
 303         uint64_t count = (uint64_t)0, offset = (uint64_t) 0;
 304         uint32 lock_pid;
 305         unsigned char locktype = CVAL(blr->req->vwv+3, 0);
 306         bool large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES);
 307         uint8_t *data;
 308         int i;
 309
 310         data = (uint8_t *)blr->req->buf
 311                 + ((large_file_format ? 20 : 10)*num_ulocks);
 312
 313         /*
 314          * Data now points at the beginning of the list
 315          * of smb_lkrng structs.
 316          */
 317
 318         /*
 319          * Ensure we don't do a remove on the lock that just failed,
 320          * as under POSIX rules, if we have a lock already there, we
 321          * will delete it (and we shouldn't) .....
 322          */
 323
 324         for(i = blr->lock_num - 1; i >= 0; i--) {
 325                 bool err;
 326
 327                 lock_pid = get_lock_pid( data, i, large_file_format);
 328                 count = get_lock_count( data, i, large_file_format);
 329                 offset = get_lock_offset( data, i, large_file_format, &err);
 330
 331                 /*
 332                  * We know err cannot be set as if it was the lock
 333                  * request would never have been queued. JRA.
 334                  */
 335
 336                 do_unlock(smbd_messaging_context(),
 337                         fsp,
 338                         lock_pid,
 339                         count,
 340                         offset,
 341                         WINDOWS_LOCK);
 342         }
 343
 344         generic_blocking_lock_error(blr, status);
 345 }
 346
 347 /****************************************************************************
 348  Return a lock fail error.
 349 *****************************************************************************/
 350
 351 static void blocking_lock_reply_error(blocking_lock_record *blr, NTSTATUS status)
 352 {
 353         switch(blr->req->cmd) {
 354         case SMBlockingX:
 355                 reply_lockingX_error(blr, status);
 356                 break;
 357         case SMBtrans2:
 358         case SMBtranss2:
 359                 reply_nterror(blr->req, status);
 360
 361                 /*
 362                  * construct_reply_common has done us the favor to pre-fill
 363                  * the command field with SMBtranss2 which is wrong :-)
 364                  */
 365                 SCVAL(blr->req->outbuf,smb_com,SMBtrans2);
 366
 367                 if (!srv_send_smb(smbd_server_fd(),
 368                                   (char *)blr->req->outbuf,
 369                                   IS_CONN_ENCRYPTED(blr->fsp->conn))) {
 370                         exit_server_cleanly("blocking_lock_reply_error: "
 371                                             "srv_send_smb failed.");
 372                 }
 373                 TALLOC_FREE(blr->req->outbuf);
 374                 break;
 375         default:
 376                 DEBUG(0,("blocking_lock_reply_error: PANIC - unknown type on blocking lock queue - exiting.!\n"));
 377                 exit_server("PANIC - unknown type on blocking lock queue");
 378         }
 379 }
 380
 381 /****************************************************************************
 382  Attempt to finish off getting all pending blocking locks for a lockingX call.
 383  Returns True if we want to be removed from the list.
 384 *****************************************************************************/
 385
 386 static bool process_lockingX(blocking_lock_record *blr)
 387 {
 388         unsigned char locktype = CVAL(blr->req->vwv+3, 0);
 389         files_struct *fsp = blr->fsp;
 390         uint16 num_ulocks = SVAL(blr->req->vwv+6, 0);
 391         uint16 num_locks = SVAL(blr->req->vwv+7, 0);
 392         uint64_t count = (uint64_t)0, offset = (uint64_t)0;
 393         uint32 lock_pid;
 394         bool large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES);
 395         uint8_t *data;
 396         NTSTATUS status = NT_STATUS_OK;
 397
 398         data = (uint8_t *)blr->req->buf
 399                 + ((large_file_format ? 20 : 10)*num_ulocks);
 400
 401         /*
 402          * Data now points at the beginning of the list
 403          * of smb_lkrng structs.
 404          */
 405
 406         for(; blr->lock_num < num_locks; blr->lock_num++) {
 407                 struct byte_range_lock *br_lck = NULL;
 408                 bool err;
 409
 410                 lock_pid = get_lock_pid( data, blr->lock_num, large_file_format);
 411                 count = get_lock_count( data, blr->lock_num, large_file_format);
 412                 offset = get_lock_offset( data, blr->lock_num, large_file_format, &err);
 413
 414                 /*
 415                  * We know err cannot be set as if it was the lock
 416                  * request would never have been queued. JRA.
 417                  */
 418                 errno = 0;
 419                 br_lck = do_lock(smbd_messaging_context(),
 420                                 fsp,
 421                                 lock_pid,
 422                                 count,
 423                                 offset,
 424                                 ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
 425                                         READ_LOCK : WRITE_LOCK),
 426                                 WINDOWS_LOCK,
 427                                 True,
 428                                 &status,
 429                                 &blr->blocking_pid);
 430
 431                 TALLOC_FREE(br_lck);
 432
 433                 if (NT_STATUS_IS_ERR(status)) {
 434                         break;
 435                 }
 436         }
 437
 438         if(blr->lock_num == num_locks) {
 439                 /*
 440                  * Success - we got all the locks.
 441                  */
 442
 443                 DEBUG(3,("process_lockingX file = %s, fnum=%d type=%d num_locks=%d\n",
 444                          fsp->fsp_name, fsp->fnum, (unsigned int)locktype, num_locks) );
 445
 446                 reply_lockingX_success(blr);
 447                 return True;
 448         }
 449
 450         if (!NT_STATUS_EQUAL(status,NT_STATUS_LOCK_NOT_GRANTED) &&
 451             !NT_STATUS_EQUAL(status,NT_STATUS_FILE_LOCK_CONFLICT)) {
 452                 /*
 453                  * We have other than a "can't get lock"
 454                  * error. Free any locks we had and return an error.
 455                  * Return True so we get dequeued.
 456                  */
 457                 blocking_lock_reply_error(blr, status);
 458                 return True;
 459         }
 460
 461         /*
 462          * Still can't get all the locks - keep waiting.
 463          */
 464
 465         DEBUG(10,("process_lockingX: only got %d locks of %d needed for file %s, fnum = %d. \
 466 Waiting....\n",
 467                   blr->lock_num, num_locks, fsp->fsp_name, fsp->fnum));
 468
 469         return False;
 470 }
 471
 472 /****************************************************************************
 473  Attempt to get the posix lock request from a SMBtrans2 call.
 474  Returns True if we want to be removed from the list.
 475 *****************************************************************************/
 476
 477 static bool process_trans2(blocking_lock_record *blr)
 478 {
 479         char params[2];
 480         NTSTATUS status;
 481         struct byte_range_lock *br_lck = do_lock(smbd_messaging_context(),
 482                                                 blr->fsp,
 483                                                 blr->lock_pid,
 484                                                 blr->count,
 485                                                 blr->offset,
 486                                                 blr->lock_type,
 487                                                 blr->lock_flav,
 488                                                 True,
 489                                                 &status,
 490                                                 &blr->blocking_pid);
 491         TALLOC_FREE(br_lck);
 492
 493         if (!NT_STATUS_IS_OK(status)) {
 494                 if (ERROR_WAS_LOCK_DENIED(status)) {
 495                         /* Still can't get the lock, just keep waiting. */
 496                         return False;
 497                 }
 498                 /*
 499                  * We have other than a "can't get lock"
 500                  * error. Send an error and return True so we get dequeued.
 501                  */
 502                 blocking_lock_reply_error(blr, status);
 503                 return True;
 504         }
 505
 506         /* We finally got the lock, return success. */
 507
 508         SSVAL(params,0,0);
 509         /* Fake up max_data_bytes here - we know it fits. */
 510         send_trans2_replies(blr->fsp->conn, blr->req, params, 2, NULL, 0, 0xffff);
 511         return True;
 512 }
 513
 514
 515 /****************************************************************************
 516  Process a blocking lock SMB.
 517  Returns True if we want to be removed from the list.
 518 *****************************************************************************/
 519
 520 static bool blocking_lock_record_process(blocking_lock_record *blr)
 521 {
 522         switch(blr->req->cmd) {
 523                 case SMBlockingX:
 524                         return process_lockingX(blr);
 525                 case SMBtrans2:
 526                 case SMBtranss2:
 527                         return process_trans2(blr);
 528                 default:
 529                         DEBUG(0,("blocking_lock_record_process: PANIC - unknown type on blocking lock queue - exiting.!\n"));
 530                         exit_server("PANIC - unknown type on blocking lock queue");
 531         }
 532         return False; /* Keep compiler happy. */
 533 }
 534
 535 /****************************************************************************
 536  Cancel entries by fnum from the blocking lock pending queue.
 537 *****************************************************************************/
 538
 539 void cancel_pending_lock_requests_by_fid(files_struct *fsp, struct byte_range_lock *br_lck)
 540 {
 541         blocking_lock_record *blr, *next = NULL;
 542
 543         for(blr = blocking_lock_queue; blr; blr = next) {
 544                 unsigned char locktype = 0;
 545
 546                 next = blr->next;
 547                 if (blr->fsp->fnum != fsp->fnum) {
 548                         continue;
 549                 }
 550
 551                 if (blr->req->cmd == SMBlockingX) {
 552                         locktype = CVAL(blr->req->vwv+3, 0);
 553                 }
 554
 555                 DEBUG(10, ("remove_pending_lock_requests_by_fid - removing "
 556                            "request type %d for file %s fnum = %d\n",
 557                            blr->req->cmd, fsp->fsp_name, fsp->fnum));
 558
 559                 brl_lock_cancel(br_lck,
 560                                 blr->lock_pid,
 561                                 procid_self(),
 562                                 blr->offset,
 563                                 blr->count,
 564                                 blr->lock_flav);
 565
 566                 blocking_lock_cancel(fsp,
 567                                      blr->lock_pid,
 568                                      blr->offset,
 569                                      blr->count,
 570                                      blr->lock_flav,
 571                                      locktype,
 572                                      NT_STATUS_RANGE_NOT_LOCKED);
 573
 574                 /* We're closing the file fsp here, so ensure
 575                  * we don't have a dangling pointer. */
 576                 blr->fsp = NULL;
 577         }
 578 }
 579
 580 /****************************************************************************
 581  Delete entries by mid from the blocking lock pending queue. Always send reply.
 582 *****************************************************************************/
 583
 584 void remove_pending_lock_requests_by_mid(int mid)
 585 {
 586         blocking_lock_record *blr, *next = NULL;
 587
 588         for(blr = blocking_lock_queue; blr; blr = next) {
 589                 files_struct *fsp;
 590                 struct byte_range_lock *br_lck;
 591
 592                 next = blr->next;
 593
 594                 if (blr->req->mid != mid) {
 595                         continue;
 596                 }
 597
 598                 fsp = blr->fsp;
 599                 br_lck = brl_get_locks(talloc_tos(), fsp);
 600
 601                 if (br_lck) {
 602                         DEBUG(10, ("remove_pending_lock_requests_by_mid - "
 603                                    "removing request type %d for file %s fnum "
 604                                    "= %d\n", blr->req->cmd, fsp->fsp_name,
 605                                    fsp->fnum ));
 606
 607                         brl_lock_cancel(br_lck,
 608                                         blr->lock_pid,
 609                                         procid_self(),
 610                                         blr->offset,
 611                                         blr->count,
 612                                         blr->lock_flav);
 613                         TALLOC_FREE(br_lck);
 614                 }
 615
 616                 blocking_lock_reply_error(blr,NT_STATUS_FILE_LOCK_CONFLICT);
 617                 DLIST_REMOVE(blocking_lock_queue, blr);
 618                 TALLOC_FREE(blr);
 619         }
 620 }
 621
 622 /****************************************************************************
 623  Is this mid a blocking lock request on the queue ?
 624 *****************************************************************************/
 625
 626 bool blocking_lock_was_deferred(int mid)
 627 {
 628         blocking_lock_record *blr, *next = NULL;
 629
 630         for(blr = blocking_lock_queue; blr; blr = next) {
 631                 next = blr->next;
 632                 if(blr->req->mid == mid) {
 633                         return True;
 634                 }
 635         }
 636         return False;
 637 }
 638
 639 /****************************************************************************
 640   Set a flag as an unlock request affects one of our pending locks.
 641 *****************************************************************************/
 642
 643 static void received_unlock_msg(struct messaging_context *msg,
 644                                 void *private_data,
 645                                 uint32_t msg_type,
 646                                 struct server_id server_id,
 647                                 DATA_BLOB *data)
 648 {
 649         DEBUG(10,("received_unlock_msg\n"));
 650         process_blocking_lock_queue();
 651 }
 652
 653 /****************************************************************************
 654  Process the blocking lock queue. Note that this is only called as root.
 655 *****************************************************************************/
 656
 657 static void process_blocking_lock_queue(void)
 658 {
 659         struct timeval tv_curr = timeval_current();
 660         blocking_lock_record *blr, *next = NULL;
 661         bool recalc_timeout = False;
 662
 663         /*
 664          * Go through the queue and see if we can get any of the locks.
 665          */
 666
 667         for (blr = blocking_lock_queue; blr; blr = next) {
 668
 669                 next = blr->next;
 670
 671                 /*
 672                  * Go through the remaining locks and try and obtain them.
 673                  * The call returns True if all locks were obtained successfully
 674                  * and False if we still need to wait.
 675                  */
 676
 677                 if(blocking_lock_record_process(blr)) {
 678                         struct byte_range_lock *br_lck = brl_get_locks(
 679                                 talloc_tos(), blr->fsp);
 680
 681                         if (br_lck) {
 682                                 brl_lock_cancel(br_lck,
 683                                         blr->lock_pid,
 684                                         procid_self(),
 685                                         blr->offset,
 686                                         blr->count,
 687                                         blr->lock_flav);
 688                                 TALLOC_FREE(br_lck);
 689                         }
 690
 691                         DLIST_REMOVE(blocking_lock_queue, blr);
 692                         TALLOC_FREE(blr);
 693                         recalc_timeout = True;
 694                         continue;
 695                 }
 696
 697                 /*
 698                  * We couldn't get the locks for this record on the list.
 699                  * If the time has expired, return a lock error.
 700                  */
 701
 702                 if (!timeval_is_zero(&blr->expire_time) && timeval_compare(&blr->expire_time, &tv_curr) <= 0) {
 703                         struct byte_range_lock *br_lck = brl_get_locks(
 704                                 talloc_tos(), blr->fsp);
 705
 706                         /*
 707                          * Lock expired - throw away all previously
 708                          * obtained locks and return lock error.
 709                          */
 710
 711                         if (br_lck) {
 712                                 DEBUG(5,("process_blocking_lock_queue: "
 713                                          "pending lock fnum = %d for file %s "
 714                                          "timed out.\n", blr->fsp->fnum,
 715                                          blr->fsp->fsp_name ));
 716
 717                                 brl_lock_cancel(br_lck,
 718                                         blr->lock_pid,
 719                                         procid_self(),
 720                                         blr->offset,
 721                                         blr->count,
 722                                         blr->lock_flav);
 723                                 TALLOC_FREE(br_lck);
 724                         }
 725
 726                         blocking_lock_reply_error(blr,NT_STATUS_FILE_LOCK_CONFLICT);
 727                         DLIST_REMOVE(blocking_lock_queue, blr);
 728                         TALLOC_FREE(blr);
 729                         recalc_timeout = True;
 730                 }
 731         }
 732
 733         if (recalc_timeout) {
 734                 recalc_brl_timeout();
 735         }
 736 }
 737
 738 /****************************************************************************
 739  Handle a cancel message. Lock already moved onto the cancel queue.
 740 *****************************************************************************/
 741
 742 #define MSG_BLOCKING_LOCK_CANCEL_SIZE (sizeof(blocking_lock_record *) + sizeof(NTSTATUS))
 743
 744 static void process_blocking_lock_cancel_message(struct messaging_context *ctx,
 745                                                  void *private_data,
 746                                                  uint32_t msg_type,
 747                                                  struct server_id server_id,
 748                                                  DATA_BLOB *data)
 749 {
 750         NTSTATUS err;
 751         const char *msg = (const char *)data->data;
 752         blocking_lock_record *blr;
 753
 754         if (data->data == NULL) {
 755                 smb_panic("process_blocking_lock_cancel_message: null msg");
 756         }
 757
 758         if (data->length != MSG_BLOCKING_LOCK_CANCEL_SIZE) {
 759                 DEBUG(0, ("process_blocking_lock_cancel_message: "
 760                           "Got invalid msg len %d\n", (int)data->length));
 761                 smb_panic("process_blocking_lock_cancel_message: bad msg");
 762         }
 763
 764         memcpy(&blr, msg, sizeof(blr));
 765         memcpy(&err, &msg[sizeof(blr)], sizeof(NTSTATUS));
 766
 767         DEBUG(10,("process_blocking_lock_cancel_message: returning error %s\n",
 768                 nt_errstr(err) ));
 769
 770         blocking_lock_reply_error(blr, err);
 771         DLIST_REMOVE(blocking_lock_cancelled_queue, blr);
 772         TALLOC_FREE(blr);
 773 }
 774
 775 /****************************************************************************
 776  Send ourselves a blocking lock cancelled message. Handled asynchronously above.
 777 *****************************************************************************/
 778
 779 bool blocking_lock_cancel(files_struct *fsp,
 780                         uint32 lock_pid,
 781                         uint64_t offset,
 782                         uint64_t count,
 783                         enum brl_flavour lock_flav,
 784                         unsigned char locktype,
 785                         NTSTATUS err)
 786 {
 787         static bool initialized;
 788         char msg[MSG_BLOCKING_LOCK_CANCEL_SIZE];
 789         blocking_lock_record *blr;
 790
 791         if (!initialized) {
 792                 /* Register our message. */
 793                 messaging_register(smbd_messaging_context(), NULL,
 794                                    MSG_SMB_BLOCKING_LOCK_CANCEL,
 795                                    process_blocking_lock_cancel_message);
 796
 797                 initialized = True;
 798         }
 799
 800         for (blr = blocking_lock_queue; blr; blr = blr->next) {
 801                 if (fsp == blr->fsp &&
 802                                 lock_pid == blr->lock_pid &&
 803                                 offset == blr->offset &&
 804                                 count == blr->count &&
 805                                 lock_flav == blr->lock_flav) {
 806                         break;
 807                 }
 808         }
 809
 810         if (!blr) {
 811                 return False;
 812         }
 813
 814         /* Check the flags are right. */
 815         if (blr->req->cmd == SMBlockingX &&
 816                 (locktype & LOCKING_ANDX_LARGE_FILES) !=
 817                         (CVAL(blr->req->vwv+3, 0) & LOCKING_ANDX_LARGE_FILES)) {
 818                 return False;
 819         }
 820
 821         /* Move to cancelled queue. */
 822         DLIST_REMOVE(blocking_lock_queue, blr);
 823         DLIST_ADD(blocking_lock_cancelled_queue, blr);
 824
 825         /* Create the message. */
 826         memcpy(msg, &blr, sizeof(blr));
 827         memcpy(&msg[sizeof(blr)], &err, sizeof(NTSTATUS));
 828
 829         messaging_send_buf(smbd_messaging_context(), procid_self(),
 830                            MSG_SMB_BLOCKING_LOCK_CANCEL,
 831                            (uint8 *)&msg, sizeof(msg));
 832
 833         return True;
 834 }