smbd: Fix a panic master
authorVolker Lendecke <vl@samba.org>
Tue, 21 May 2019 13:26:55 +0000 (15:26 +0200)
committerRalph Boehme <slow@samba.org>
Wed, 22 May 2019 20:09:29 +0000 (20:09 +0000)
Opening a file with a stale (smbd died) LEVEL_II oplock makes

vfs_set_filelen-> ... ->contend_level2_oplocks_begin_default

trigger the immediate leading to do_break_to_none. This goes through
because fsp->oplock_type is not initialized yet, thus 0. Also,
file_has_read_oplocks is still valid, because the smbd that has died
could not clean up the brlock.tdb entry.

Later in the code the exclusive oplock is granted, which is then found
by do_break_to_none, making it panic.

This patch just runs the direct FTRUNCATE instead of vfs_set_filelen.
This means the contend_level2_oplock code is skipped.

The relevant break (LEVEL_II to NONE) is now done in delay_for_oplock()
with the nice effect of removing a comment that was very confusing to
me.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13957
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph B√∂hme <slow@samba.org>
Autobuild-Date(master): Wed May 22 20:09:29 UTC 2019 on sn-devel-184

selftest/knownfail
source3/smbd/open.c

index e3572d7..2c31bf9 100644 (file)
 ^samba3.smb2.dir.modify
 ^samba3.smb2.oplock.batch20
 ^samba3.smb2.oplock.stream1
-^samba3.smb2.oplock.levelii502
 ^samba3.smb2.streams.rename
 ^samba3.smb2.streams.rename2
 ^samba3.smb2.streams.attributes
index ec7906b..0a4abe0 100644 (file)
@@ -1911,12 +1911,7 @@ static bool delay_for_oplock(files_struct *fsp,
                break_to = e_lease_type & ~delay_mask;
 
                if (will_overwrite) {
-                       /*
-                        * we'll decide about SMB2_LEASE_READ later.
-                        *
-                        * Maybe the break will be deferred
-                        */
-                       break_to &= ~SMB2_LEASE_HANDLE;
+                       break_to &= ~(SMB2_LEASE_HANDLE|SMB2_LEASE_READ);
                }
 
                DEBUG(10, ("entry %u: e_lease_type %u, will_overwrite: %u\n",
@@ -3675,13 +3670,17 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
            (!S_ISFIFO(fsp->fsp_name->st.st_ex_mode))) {
                int ret;
 
-               ret = vfs_set_filelen(fsp, 0);
+               ret = SMB_VFS_FTRUNCATE(fsp, 0);
                if (ret != 0) {
                        status = map_nt_error_from_unix(errno);
                        TALLOC_FREE(lck);
                        fd_close(fsp);
                        return status;
                }
+               notify_fname(fsp->conn, NOTIFY_ACTION_MODIFIED,
+                            FILE_NOTIFY_CHANGE_SIZE
+                            | FILE_NOTIFY_CHANGE_ATTRIBUTES,
+                            fsp->fsp_name->base_name);
        }
 
        /*