CVE-2018-10919 security: Add more comments to the object-specific access checks
[vlendec/samba-autobuild/.git] / source3 / locking / posix.c
index 17945399c59ceff51b700c9f381453c48a92d51a..ff794282114af0186121f2d50c933495ec3fb51f 100644 (file)
 */
 
 #include "includes.h"
+#include "system/filesys.h"
+#include "lib/util/server_id.h"
+#include "locking/proto.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_rbt.h"
+#include "util_tdb.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_LOCKING
@@ -78,51 +84,38 @@ static const char *posix_lock_type_name(int lock_type)
  False if not.
 ****************************************************************************/
 
-static bool posix_lock_in_range(SMB_OFF_T *offset_out, SMB_OFF_T *count_out,
+static bool posix_lock_in_range(off_t *offset_out, off_t *count_out,
                                uint64_t u_offset, uint64_t u_count)
 {
-       SMB_OFF_T offset = (SMB_OFF_T)u_offset;
-       SMB_OFF_T count = (SMB_OFF_T)u_count;
+       off_t offset = (off_t)u_offset;
+       off_t count = (off_t)u_count;
 
        /*
         * For the type of system we are, attempt to
-        * find the maximum positive lock offset as an SMB_OFF_T.
+        * find the maximum positive lock offset as an off_t.
         */
 
 #if defined(MAX_POSITIVE_LOCK_OFFSET) /* Some systems have arbitrary limits. */
 
-       SMB_OFF_T max_positive_lock_offset = (MAX_POSITIVE_LOCK_OFFSET);
-
-#elif defined(LARGE_SMB_OFF_T) && !defined(HAVE_BROKEN_FCNTL64_LOCKS)
-
+       off_t max_positive_lock_offset = (MAX_POSITIVE_LOCK_OFFSET);
+#else
        /*
-        * In this case SMB_OFF_T is 64 bits,
+        * In this case off_t is 64 bits,
         * and the underlying system can handle 64 bit signed locks.
         */
 
-       SMB_OFF_T mask2 = ((SMB_OFF_T)0x4) << (SMB_OFF_T_BITS-4);
-       SMB_OFF_T mask = (mask2<<1);
-       SMB_OFF_T max_positive_lock_offset = ~mask;
-
-#else /* !LARGE_SMB_OFF_T || HAVE_BROKEN_FCNTL64_LOCKS */
-
-       /*
-        * In this case either SMB_OFF_T is 32 bits,
-        * or the underlying system cannot handle 64 bit signed locks.
-        * All offsets & counts must be 2^31 or less.
-        */
-
-       SMB_OFF_T max_positive_lock_offset = 0x7FFFFFFF;
-
-#endif /* !LARGE_SMB_OFF_T || HAVE_BROKEN_FCNTL64_LOCKS */
+       off_t mask2 = ((off_t)0x4) << (SMB_OFF_T_BITS-4);
+       off_t mask = (mask2<<1);
+       off_t max_positive_lock_offset = ~mask;
 
+#endif
        /*
         * POSIX locks of length zero mean lock to end-of-file.
         * Win32 locks of length zero are point probes. Ignore
         * any Win32 locks of length zero. JRA.
         */
 
-       if (count == (SMB_OFF_T)0) {
+       if (count == 0) {
                DEBUG(10,("posix_lock_in_range: count = 0, ignoring.\n"));
                return False;
        }
@@ -133,8 +126,10 @@ static bool posix_lock_in_range(SMB_OFF_T *offset_out, SMB_OFF_T *count_out,
         */
 
        if (u_offset & ~((uint64_t)max_positive_lock_offset)) {
-               DEBUG(10,("posix_lock_in_range: (offset = %.0f) offset > %.0f and we cannot handle this. Ignoring lock.\n",
-                               (double)u_offset, (double)((uint64_t)max_positive_lock_offset) ));
+               DEBUG(10, ("posix_lock_in_range: (offset = %ju) offset > %ju "
+                          "and we cannot handle this. Ignoring lock.\n",
+                          (uintmax_t)u_offset,
+                          (uintmax_t)max_positive_lock_offset));
                return False;
        }
 
@@ -159,8 +154,10 @@ static bool posix_lock_in_range(SMB_OFF_T *offset_out, SMB_OFF_T *count_out,
         */
 
        if (count == 0) {
-               DEBUG(10,("posix_lock_in_range: Count = 0. Ignoring lock u_offset = %.0f, u_count = %.0f\n",
-                               (double)u_offset, (double)u_count ));
+               DEBUG(10, ("posix_lock_in_range: Count = 0. Ignoring lock "
+                          "u_offset = %ju, u_count = %ju\n",
+                          (uintmax_t)u_offset,
+                          (uintmax_t)u_count));
                return False;
        }
 
@@ -168,8 +165,9 @@ static bool posix_lock_in_range(SMB_OFF_T *offset_out, SMB_OFF_T *count_out,
         * The mapping was successful.
         */
 
-       DEBUG(10,("posix_lock_in_range: offset_out = %.0f, count_out = %.0f\n",
-                       (double)offset, (double)count ));
+       DEBUG(10, ("posix_lock_in_range: offset_out = %ju, "
+                  "count_out = %ju\n",
+                  (uintmax_t)offset, (uintmax_t)count));
 
        *offset_out = offset;
        *count_out = count;
@@ -178,11 +176,11 @@ static bool posix_lock_in_range(SMB_OFF_T *offset_out, SMB_OFF_T *count_out,
 }
 
 bool smb_vfs_call_lock(struct vfs_handle_struct *handle,
-                      struct files_struct *fsp, int op, SMB_OFF_T offset,
-                      SMB_OFF_T count, int type)
+                      struct files_struct *fsp, int op, off_t offset,
+                      off_t count, int type)
 {
        VFS_FIND(lock);
-       return handle->fns->lock(handle, fsp, op, offset, count, type);
+       return handle->fns->lock_fn(handle, fsp, op, offset, count, type);
 }
 
 /****************************************************************************
@@ -190,32 +188,45 @@ bool smb_vfs_call_lock(struct vfs_handle_struct *handle,
  broken NFS implementations.
 ****************************************************************************/
 
-static bool posix_fcntl_lock(files_struct *fsp, int op, SMB_OFF_T offset, SMB_OFF_T count, int type)
+static bool posix_fcntl_lock(files_struct *fsp, int op, off_t offset, off_t count, int type)
 {
        bool ret;
 
-       DEBUG(8,("posix_fcntl_lock %d %d %.0f %.0f %d\n",fsp->fh->fd,op,(double)offset,(double)count,type));
+       DEBUG(8,("posix_fcntl_lock %d %d %jd %jd %d\n",
+                fsp->fh->fd,op,(intmax_t)offset,(intmax_t)count,type));
 
        ret = SMB_VFS_LOCK(fsp, op, offset, count, type);
 
        if (!ret && ((errno == EFBIG) || (errno == ENOLCK) || (errno ==  EINVAL))) {
 
-               DEBUG(0,("posix_fcntl_lock: WARNING: lock request at offset %.0f, length %.0f returned\n",
-                                       (double)offset,(double)count));
-               DEBUGADD(0,("an %s error. This can happen when using 64 bit lock offsets\n", strerror(errno)));
-               DEBUGADD(0,("on 32 bit NFS mounted file systems.\n"));
+               if ((errno == EINVAL) &&
+                               (op != F_GETLK &&
+                                op != F_SETLK &&
+                                op != F_SETLKW)) {
+                       DEBUG(0,("WARNING: OFD locks in use and no kernel "
+                               "support. Try setting "
+                               "'smbd:force process locks = true' "
+                               "in smb.conf\n"));
+               } else {
+                       DEBUG(0, ("WARNING: lock request at offset "
+                         "%ju, length %ju returned\n",
+                         (uintmax_t)offset, (uintmax_t)count));
+                       DEBUGADD(0, ("an %s error. This can happen when using 64 bit "
+                            "lock offsets\n", strerror(errno)));
+                       DEBUGADD(0, ("on 32 bit NFS mounted file systems.\n"));
+               }
 
                /*
                 * If the offset is > 0x7FFFFFFF then this will cause problems on
                 * 32 bit NFS mounted filesystems. Just ignore it.
                 */
 
-               if (offset & ~((SMB_OFF_T)0x7fffffff)) {
+               if (offset & ~((off_t)0x7fffffff)) {
                        DEBUG(0,("Offset greater than 31 bits. Returning success.\n"));
                        return True;
                }
 
-               if (count & ~((SMB_OFF_T)0x7fffffff)) {
+               if (count & ~((off_t)0x7fffffff)) {
                        /* 32 bit NFS file system, retry with smaller offset */
                        DEBUG(0,("Count greater than 31 bits - retrying with 31 bit truncated length.\n"));
                        errno = 0;
@@ -229,11 +240,12 @@ static bool posix_fcntl_lock(files_struct *fsp, int op, SMB_OFF_T offset, SMB_OF
 }
 
 bool smb_vfs_call_getlock(struct vfs_handle_struct *handle,
-                         struct files_struct *fsp, SMB_OFF_T *poffset,
-                         SMB_OFF_T *pcount, int *ptype, pid_t *ppid)
+                         struct files_struct *fsp, off_t *poffset,
+                         off_t *pcount, int *ptype, pid_t *ppid)
 {
        VFS_FIND(getlock);
-       return handle->fns->getlock(handle, fsp, poffset, pcount, ptype, ppid);
+       return handle->fns->getlock_fn(handle, fsp, poffset, pcount, ptype, 
+                                      ppid);
 }
 
 /****************************************************************************
@@ -241,34 +253,37 @@ bool smb_vfs_call_getlock(struct vfs_handle_struct *handle,
  broken NFS implementations.
 ****************************************************************************/
 
-static bool posix_fcntl_getlock(files_struct *fsp, SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype)
+static bool posix_fcntl_getlock(files_struct *fsp, off_t *poffset, off_t *pcount, int *ptype)
 {
        pid_t pid;
        bool ret;
 
-       DEBUG(8,("posix_fcntl_getlock %d %.0f %.0f %d\n",
-               fsp->fh->fd,(double)*poffset,(double)*pcount,*ptype));
+       DEBUG(8, ("posix_fcntl_getlock %d %ju %ju %d\n",
+                 fsp->fh->fd, (uintmax_t)*poffset, (uintmax_t)*pcount,
+                 *ptype));
 
        ret = SMB_VFS_GETLOCK(fsp, poffset, pcount, ptype, &pid);
 
        if (!ret && ((errno == EFBIG) || (errno == ENOLCK) || (errno ==  EINVAL))) {
 
-               DEBUG(0,("posix_fcntl_getlock: WARNING: lock request at offset %.0f, length %.0f returned\n",
-                                       (double)*poffset,(double)*pcount));
-               DEBUGADD(0,("an %s error. This can happen when using 64 bit lock offsets\n", strerror(errno)));
-               DEBUGADD(0,("on 32 bit NFS mounted file systems.\n"));
+               DEBUG(0, ("posix_fcntl_getlock: WARNING: lock request at "
+                         "offset %ju, length %ju returned\n",
+                         (uintmax_t)*poffset, (uintmax_t)*pcount));
+               DEBUGADD(0, ("an %s error. This can happen when using 64 bit "
+                            "lock offsets\n", strerror(errno)));
+               DEBUGADD(0, ("on 32 bit NFS mounted file systems.\n"));
 
                /*
                 * If the offset is > 0x7FFFFFFF then this will cause problems on
                 * 32 bit NFS mounted filesystems. Just ignore it.
                 */
 
-               if (*poffset & ~((SMB_OFF_T)0x7fffffff)) {
+               if (*poffset & ~((off_t)0x7fffffff)) {
                        DEBUG(0,("Offset greater than 31 bits. Returning success.\n"));
                        return True;
                }
 
-               if (*pcount & ~((SMB_OFF_T)0x7fffffff)) {
+               if (*pcount & ~((off_t)0x7fffffff)) {
                        /* 32 bit NFS file system, retry with smaller offset */
                        DEBUG(0,("Count greater than 31 bits - retrying with 31 bit truncated length.\n"));
                        errno = 0;
@@ -292,13 +307,13 @@ bool is_posix_locked(files_struct *fsp,
                        enum brl_type *plock_type,
                        enum brl_flavour lock_flav)
 {
-       SMB_OFF_T offset;
-       SMB_OFF_T count;
+       off_t offset;
+       off_t count;
        int posix_lock_type = map_posix_lock_type(fsp,*plock_type);
 
-       DEBUG(10,("is_posix_locked: File %s, offset = %.0f, count = %.0f, "
-                 "type = %s\n", fsp_str_dbg(fsp), (double)*pu_offset,
-                 (double)*pu_count,  posix_lock_type_name(*plock_type)));
+       DEBUG(10, ("is_posix_locked: File %s, offset = %ju, count = %ju, "
+                  "type = %s\n", fsp_str_dbg(fsp), (uintmax_t)*pu_offset,
+                  (uintmax_t)*pu_count,  posix_lock_type_name(*plock_type)));
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -342,7 +357,7 @@ struct lock_ref_count_key {
  Form a static locking key for a dev/inode pair for the lock ref count
 ******************************************************************/
 
-static TDB_DATA locking_ref_count_key_fsp(files_struct *fsp,
+static TDB_DATA locking_ref_count_key_fsp(const files_struct *fsp,
                                          struct lock_ref_count_key *tmp)
 {
        ZERO_STRUCTP(tmp);
@@ -355,9 +370,9 @@ static TDB_DATA locking_ref_count_key_fsp(files_struct *fsp,
  Convenience function to get an fd_array key from an fsp.
 ******************************************************************/
 
-static TDB_DATA fd_array_key_fsp(files_struct *fsp)
+static TDB_DATA fd_array_key_fsp(const files_struct *fsp)
 {
-       return make_tdb_data((uint8 *)&fsp->file_id, sizeof(fsp->file_id));
+       return make_tdb_data((const uint8_t *)&fsp->file_id, sizeof(fsp->file_id));
 }
 
 /*******************************************************************
@@ -399,118 +414,71 @@ bool posix_locking_end(void)
 ****************************************************************************/
 
 /****************************************************************************
- The records in posix_pending_close_tdb are composed of an array of ints
- keyed by dev/ino pair.
- The first int is a reference count of the number of outstanding locks on
- all open fd's on this dev/ino pair. Any subsequent ints are the fd's that
- were open on this dev/ino pair that should have been closed, but can't as
- the lock ref count is non zero.
+ The records in posix_pending_close_db are composed of an array of
+ ints keyed by dev/ino pair. Those ints are the fd's that were open on
+ this dev/ino pair that should have been closed, but can't as the lock
+ ref count is non zero.
 ****************************************************************************/
 
 /****************************************************************************
- Keep a reference count of the number of Windows locks open on this dev/ino
+ Keep a reference count of the number of locks open on this dev/ino
  pair. Creates entry if it doesn't exist.
 ****************************************************************************/
 
-static void increment_windows_lock_ref_count(files_struct *fsp)
+static void increment_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
-       struct db_record *rec;
-       int lock_ref_count = 0;
+       int32_t lock_ref_count = 0;
        NTSTATUS status;
 
-       rec = posix_pending_close_db->fetch_locked(
-               posix_pending_close_db, talloc_tos(),
-               locking_ref_count_key_fsp(fsp, &tmp));
-
-       SMB_ASSERT(rec != NULL);
-
-       if (rec->value.dptr != NULL) {
-               SMB_ASSERT(rec->value.dsize == sizeof(lock_ref_count));
-               memcpy(&lock_ref_count, rec->value.dptr,
-                      sizeof(lock_ref_count));
-       }
-
-       lock_ref_count++;
-
-       status = rec->store(rec, make_tdb_data((uint8 *)&lock_ref_count,
-                                              sizeof(lock_ref_count)), 0);
+       status = dbwrap_change_int32_atomic(
+               posix_pending_close_db, locking_ref_count_key_fsp(fsp, &tmp),
+               &lock_ref_count, 1);
 
        SMB_ASSERT(NT_STATUS_IS_OK(status));
+       SMB_ASSERT(lock_ref_count < INT32_MAX);
 
-       TALLOC_FREE(rec);
-
-       DEBUG(10,("increment_windows_lock_ref_count for file now %s = %d\n",
-                 fsp_str_dbg(fsp), lock_ref_count));
+       DEBUG(10,("lock_ref_count for file %s = %d\n",
+                 fsp_str_dbg(fsp), (int)lock_ref_count));
 }
 
-/****************************************************************************
- Bulk delete - subtract as many locks as we've just deleted.
-****************************************************************************/
-
-void reduce_windows_lock_ref_count(files_struct *fsp, unsigned int dcount)
+static void decrement_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
-       struct db_record *rec;
-       int lock_ref_count = 0;
+       int32_t lock_ref_count = 0;
        NTSTATUS status;
 
-       rec = posix_pending_close_db->fetch_locked(
-               posix_pending_close_db, talloc_tos(),
-               locking_ref_count_key_fsp(fsp, &tmp));
-
-       SMB_ASSERT((rec != NULL)
-                  && (rec->value.dptr != NULL)
-                  && (rec->value.dsize == sizeof(lock_ref_count)));
-
-       memcpy(&lock_ref_count, rec->value.dptr, sizeof(lock_ref_count));
-
-       SMB_ASSERT(lock_ref_count > 0);
-
-       lock_ref_count -= dcount;
-
-       status = rec->store(rec, make_tdb_data((uint8 *)&lock_ref_count,
-                                              sizeof(lock_ref_count)), 0);
+       status = dbwrap_change_int32_atomic(
+               posix_pending_close_db, locking_ref_count_key_fsp(fsp, &tmp),
+               &lock_ref_count, -1);
 
        SMB_ASSERT(NT_STATUS_IS_OK(status));
+       SMB_ASSERT(lock_ref_count >= 0);
 
-       TALLOC_FREE(rec);
-
-       DEBUG(10,("reduce_windows_lock_ref_count for file now %s = %d\n",
-                 fsp_str_dbg(fsp), lock_ref_count));
-}
-
-static void decrement_windows_lock_ref_count(files_struct *fsp)
-{
-       reduce_windows_lock_ref_count(fsp, 1);
+       DEBUG(10,("lock_ref_count for file %s = %d\n",
+                 fsp_str_dbg(fsp), (int)lock_ref_count));
 }
 
 /****************************************************************************
  Fetch the lock ref count.
 ****************************************************************************/
 
-static int get_windows_lock_ref_count(files_struct *fsp)
+static int32_t get_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
-       TDB_DATA dbuf;
-       int res;
-       int lock_ref_count = 0;
-
-       res = posix_pending_close_db->fetch(
-               posix_pending_close_db, talloc_tos(),
-               locking_ref_count_key_fsp(fsp, &tmp), &dbuf);
+       NTSTATUS status;
+       int32_t lock_ref_count = 0;
 
-       SMB_ASSERT(res == 0);
+       status = dbwrap_fetch_int32(
+               posix_pending_close_db, locking_ref_count_key_fsp(fsp, &tmp),
+               &lock_ref_count);
 
-       if (dbuf.dsize != 0) {
-               SMB_ASSERT(dbuf.dsize == sizeof(lock_ref_count));
-               memcpy(&lock_ref_count, dbuf.dptr, sizeof(lock_ref_count));
-               TALLOC_FREE(dbuf.dptr);
+       if (!NT_STATUS_IS_OK(status) &&
+           !NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
+               DEBUG(0, ("Error fetching "
+                         "lock ref count for file %s: %s\n",
+                         fsp_str_dbg(fsp), nt_errstr(status)));
        }
-
-       DEBUG(10,("get_windows_lock_count for file %s = %d\n",
-                 fsp_str_dbg(fsp), lock_ref_count));
-
        return lock_ref_count;
 }
 
@@ -518,23 +486,16 @@ static int get_windows_lock_ref_count(files_struct *fsp)
  Delete a lock_ref_count entry.
 ****************************************************************************/
 
-static void delete_windows_lock_ref_count(files_struct *fsp)
+static void delete_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
-       struct db_record *rec;
-
-       rec = posix_pending_close_db->fetch_locked(
-               posix_pending_close_db, talloc_tos(),
-               locking_ref_count_key_fsp(fsp, &tmp));
-
-       SMB_ASSERT(rec != NULL);
 
        /* Not a bug if it doesn't exist - no locks were ever granted. */
 
-       rec->delete_rec(rec);
-       TALLOC_FREE(rec);
+       dbwrap_delete(posix_pending_close_db,
+                     locking_ref_count_key_fsp(fsp, &tmp));
 
-       DEBUG(10,("delete_windows_lock_ref_count for file %s\n",
+       DEBUG(10,("delete_lock_ref_count for file %s\n",
                  fsp_str_dbg(fsp)));
 }
 
@@ -542,30 +503,33 @@ static void delete_windows_lock_ref_count(files_struct *fsp)
  Add an fd to the pending close tdb.
 ****************************************************************************/
 
-static void add_fd_to_close_entry(files_struct *fsp)
+static void add_fd_to_close_entry(const files_struct *fsp)
 {
        struct db_record *rec;
-       uint8_t *new_data;
+       int *fds;
+       size_t num_fds;
        NTSTATUS status;
+       TDB_DATA value;
 
-       rec = posix_pending_close_db->fetch_locked(
+       rec = dbwrap_fetch_locked(
                posix_pending_close_db, talloc_tos(),
                fd_array_key_fsp(fsp));
 
        SMB_ASSERT(rec != NULL);
 
-       new_data = TALLOC_ARRAY(
-               rec, uint8_t, rec->value.dsize + sizeof(fsp->fh->fd));
+       value = dbwrap_record_get_value(rec);
+       SMB_ASSERT((value.dsize % sizeof(int)) == 0);
 
-       SMB_ASSERT(new_data != NULL);
+       num_fds = value.dsize / sizeof(int);
+       fds = talloc_array(rec, int, num_fds+1);
 
-       memcpy(new_data, rec->value.dptr, rec->value.dsize);
-       memcpy(new_data + rec->value.dsize,
-              &fsp->fh->fd, sizeof(fsp->fh->fd));
+       SMB_ASSERT(fds != NULL);
 
-       status = rec->store(
-               rec, make_tdb_data(new_data,
-                                  rec->value.dsize + sizeof(fsp->fh->fd)), 0);
+       memcpy(fds, value.dptr, value.dsize);
+       fds[num_fds] = fsp->fh->fd;
+
+       status = dbwrap_record_store(
+               rec, make_tdb_data((uint8_t *)fds, talloc_get_size(fds)), 0);
 
        SMB_ASSERT(NT_STATUS_IS_OK(status));
 
@@ -579,16 +543,16 @@ static void add_fd_to_close_entry(files_struct *fsp)
  Remove all fd entries for a specific dev/inode pair from the tdb.
 ****************************************************************************/
 
-static void delete_close_entries(files_struct *fsp)
+static void delete_close_entries(const files_struct *fsp)
 {
        struct db_record *rec;
 
-       rec = posix_pending_close_db->fetch_locked(
+       rec = dbwrap_fetch_locked(
                posix_pending_close_db, talloc_tos(),
                fd_array_key_fsp(fsp));
 
        SMB_ASSERT(rec != NULL);
-       rec->delete_rec(rec);
+       dbwrap_record_delete(rec);
        TALLOC_FREE(rec);
 }
 
@@ -598,16 +562,22 @@ static void delete_close_entries(files_struct *fsp)
 ****************************************************************************/
 
 static size_t get_posix_pending_close_entries(TALLOC_CTX *mem_ctx,
-                                             files_struct *fsp, int **entries)
+                                       const files_struct *fsp,
+                                       int **entries)
 {
        TDB_DATA dbuf;
-       int res;
+       NTSTATUS status;
 
-       res = posix_pending_close_db->fetch(
+       status = dbwrap_fetch(
                posix_pending_close_db, mem_ctx, fd_array_key_fsp(fsp),
                &dbuf);
 
-       SMB_ASSERT(res == 0);
+       if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
+               *entries = NULL;
+               return 0;
+       }
+
+       SMB_ASSERT(NT_STATUS_IS_OK(status));
 
        if (dbuf.dsize == 0) {
                *entries = NULL;
@@ -624,7 +594,7 @@ static size_t get_posix_pending_close_entries(TALLOC_CTX *mem_ctx,
  to delete all locks on this fsp before this function is called.
 ****************************************************************************/
 
-int fd_close_posix(struct files_struct *fsp)
+int fd_close_posix(const struct files_struct *fsp)
 {
        int saved_errno = 0;
        int ret;
@@ -632,17 +602,18 @@ int fd_close_posix(struct files_struct *fsp)
        size_t count, i;
 
        if (!lp_locking(fsp->conn->params) ||
-           !lp_posix_locking(fsp->conn->params))
+           !lp_posix_locking(fsp->conn->params) ||
+           fsp->use_ofd_locks)
        {
                /*
-                * No locking or POSIX to worry about or we want POSIX semantics
-                * which will lose all locks on all fd's open on this dev/inode,
-                * just close.
+                * No locking or POSIX to worry about or we are using POSIX
+                * open file description lock semantics which only removes
+                * locks on the file descriptor we're closing. Just close.
                 */
                return close(fsp->fh->fd);
        }
 
-       if (get_windows_lock_ref_count(fsp)) {
+       if (get_lock_ref_count(fsp)) {
 
                /*
                 * There are outstanding locks on this dev/inode pair on
@@ -682,7 +653,7 @@ int fd_close_posix(struct files_struct *fsp)
        TALLOC_FREE(fd_array);
 
        /* Don't need a lock ref count on this dev/ino anymore. */
-       delete_windows_lock_ref_count(fsp);
+       delete_lock_ref_count(fsp);
 
        /*
         * Finally close the fd associated with this fsp.
@@ -711,8 +682,8 @@ int fd_close_posix(struct files_struct *fsp)
 struct lock_list {
        struct lock_list *next;
        struct lock_list *prev;
-       SMB_OFF_T start;
-       SMB_OFF_T size;
+       off_t start;
+       off_t size;
 };
 
 /****************************************************************************
@@ -724,7 +695,6 @@ struct lock_list {
 static struct lock_list *posix_lock_list(TALLOC_CTX *ctx,
                                                struct lock_list *lhead,
                                                const struct lock_context *lock_ctx, /* Lock context lhead belongs to. */
-                                               files_struct *fsp,
                                                const struct lock_struct *plocks,
                                                int num_locks)
 {
@@ -735,8 +705,8 @@ static struct lock_list *posix_lock_list(TALLOC_CTX *ctx,
         * Quit if the list is deleted.
         */
 
-       DEBUG(10,("posix_lock_list: curr: start=%.0f,size=%.0f\n",
-               (double)lhead->start, (double)lhead->size ));
+       DEBUG(10, ("posix_lock_list: curr: start=%ju,size=%ju\n",
+                  (uintmax_t)lhead->start, (uintmax_t)lhead->size ));
 
        for (i=0; i<num_locks && lhead; i++) {
                const struct lock_struct *lock = &plocks[i];
@@ -748,7 +718,7 @@ static struct lock_list *posix_lock_list(TALLOC_CTX *ctx,
                }
 
                /* Ignore locks not owned by this process. */
-               if (!procid_equal(&lock->context.pid, &lock_ctx->pid)) {
+               if (!serverid_equal(&lock->context.pid, &lock_ctx->pid)) {
                        continue;
                }
 
@@ -760,8 +730,12 @@ static struct lock_list *posix_lock_list(TALLOC_CTX *ctx,
 
                for (l_curr = lhead; l_curr;) {
 
-                       DEBUG(10,("posix_lock_list: lock: fnum=%d: start=%.0f,size=%.0f:type=%s", lock->fnum,
-                               (double)lock->start, (double)lock->size, posix_lock_type_name(lock->lock_type) ));
+                       DEBUG(10, ("posix_lock_list: lock: fnum=%ju: "
+                                  "start=%ju,size=%ju:type=%s",
+                                  (uintmax_t)lock->fnum,
+                                  (uintmax_t)lock->start,
+                                  (uintmax_t)lock->size,
+                                  posix_lock_type_name(lock->lock_type) ));
 
                        if ( (l_curr->start >= (lock->start + lock->size)) ||
                                 (lock->start >= (l_curr->start + l_curr->size))) {
@@ -835,8 +809,10 @@ BECOMES....
                                l_curr->size = (l_curr->start + l_curr->size) - (lock->start + lock->size);
                                l_curr->start = lock->start + lock->size;
 
-                               DEBUG(10,(" truncate high case: start=%.0f,size=%.0f\n",
-                                                               (double)l_curr->start, (double)l_curr->size ));
+                               DEBUG(10, (" truncate high case: start=%ju,"
+                                          "size=%ju\n",
+                                          (uintmax_t)l_curr->start,
+                                          (uintmax_t)l_curr->size ));
 
                                l_curr = l_curr->next;
 
@@ -863,8 +839,10 @@ BECOMES....
 
                                l_curr->size = lock->start - l_curr->start;
 
-                               DEBUG(10,(" truncate low case: start=%.0f,size=%.0f\n",
-                                                               (double)l_curr->start, (double)l_curr->size ));
+                               DEBUG(10, (" truncate low case: start=%ju,"
+                                          "size=%ju\n",
+                                          (uintmax_t)l_curr->start,
+                                          (uintmax_t)l_curr->size ));
 
                                l_curr = l_curr->next;
                
@@ -888,7 +866,7 @@ BECOMES.....
         | l_curr|         | l_new   |
         +-------+         +---------+
 **********************************************/
-                               struct lock_list *l_new = TALLOC_P(ctx, struct lock_list);
+                               struct lock_list *l_new = talloc(ctx, struct lock_list);
 
                                if(l_new == NULL) {
                                        DEBUG(0,("posix_lock_list: talloc fail.\n"));
@@ -902,18 +880,18 @@ BECOMES.....
                                /* Truncate the l_curr. */
                                l_curr->size = lock->start - l_curr->start;
 
-                               DEBUG(10,(" split case: curr: start=%.0f,size=%.0f \
-new: start=%.0f,size=%.0f\n", (double)l_curr->start, (double)l_curr->size,
-                                                               (double)l_new->start, (double)l_new->size ));
+                               DEBUG(10, (" split case: curr: start=%ju,"
+                                          "size=%ju new: start=%ju,"
+                                          "size=%ju\n",
+                                          (uintmax_t)l_curr->start,
+                                          (uintmax_t)l_curr->size,
+                                          (uintmax_t)l_new->start,
+                                          (uintmax_t)l_new->size ));
 
                                /*
                                 * Add into the dlink list after the l_curr point - NOT at lhead. 
-                                * Note we can't use DLINK_ADD here as this inserts at the head of the given list.
                                 */
-
-                               l_new->prev = l_curr;
-                               l_new->next = l_curr->next;
-                               l_curr->next = l_new;
+                               DLIST_ADD_AFTER(lhead, l_new, l_curr);
 
                                /* And move after the link we added. */
                                l_curr = l_new->next;
@@ -926,8 +904,14 @@ new: start=%.0f,size=%.0f\n", (double)l_curr->start, (double)l_curr->size,
                                 */
                                char *msg = NULL;
 
-                               if (asprintf(&msg, "logic flaw in cases: l_curr: start = %.0f, size = %.0f : \
-lock: start = %.0f, size = %.0f", (double)l_curr->start, (double)l_curr->size, (double)lock->start, (double)lock->size ) != -1) {
+                               if (asprintf(&msg, "logic flaw in cases: "
+                                            "l_curr: start = %ju, "
+                                            "size = %ju : lock: "
+                                            "start = %ju, size = %ju",
+                                            (uintmax_t)l_curr->start,
+                                            (uintmax_t)l_curr->size,
+                                            (uintmax_t)lock->start,
+                                            (uintmax_t)lock->size ) != -1) {
                                        smb_panic(msg);
                                } else {
                                        smb_panic("posix_lock_list");
@@ -953,8 +937,8 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
                        int num_locks,
                        int *errno_ret)
 {
-       SMB_OFF_T offset;
-       SMB_OFF_T count;
+       off_t offset;
+       off_t count;
        int posix_lock_type = map_posix_lock_type(fsp,lock_type);
        bool ret = True;
        size_t lock_count;
@@ -962,10 +946,10 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
        struct lock_list *llist = NULL;
        struct lock_list *ll = NULL;
 
-       DEBUG(5,("set_posix_lock_windows_flavour: File %s, offset = %.0f, "
-                "count = %.0f, type = %s\n", fsp_str_dbg(fsp),
-                (double)u_offset, (double)u_count,
-                posix_lock_type_name(lock_type)));
+       DEBUG(5, ("set_posix_lock_windows_flavour: File %s, offset = %ju, "
+                 "count = %ju, type = %s\n", fsp_str_dbg(fsp),
+                 (uintmax_t)u_offset, (uintmax_t)u_count,
+                 posix_lock_type_name(lock_type)));
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -973,7 +957,7 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
         */
 
        if(!posix_lock_in_range(&offset, &count, u_offset, u_count)) {
-               increment_windows_lock_ref_count(fsp);
+               increment_lock_ref_count(fsp);
                return True;
        }
 
@@ -1000,7 +984,7 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
                return False;
        }
 
-       if ((ll = TALLOC_P(l_ctx, struct lock_list)) == NULL) {
+       if ((ll = talloc(l_ctx, struct lock_list)) == NULL) {
                DEBUG(0,("set_posix_lock_windows_flavour: unable to talloc unlock list.\n"));
                talloc_destroy(l_ctx);
                return False;
@@ -1028,7 +1012,6 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
        llist = posix_lock_list(l_ctx,
                                llist,
                                lock_ctx, /* Lock context llist belongs to. */
-                               fsp,
                                plocks,
                                num_locks);
 
@@ -1042,13 +1025,19 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
                offset = ll->start;
                count = ll->size;
 
-               DEBUG(5,("set_posix_lock_windows_flavour: Real lock: Type = %s: offset = %.0f, count = %.0f\n",
-                       posix_lock_type_name(posix_lock_type), (double)offset, (double)count ));
+               DEBUG(5, ("set_posix_lock_windows_flavour: Real lock: "
+                         "Type = %s: offset = %ju, count = %ju\n",
+                         posix_lock_type_name(posix_lock_type),
+                         (uintmax_t)offset, (uintmax_t)count ));
 
-               if (!posix_fcntl_lock(fsp,SMB_F_SETLK,offset,count,posix_lock_type)) {
+               if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,posix_lock_type)) {
                        *errno_ret = errno;
-                       DEBUG(5,("set_posix_lock_windows_flavour: Lock fail !: Type = %s: offset = %.0f, count = %.0f. Errno = %s\n",
-                               posix_lock_type_name(posix_lock_type), (double)offset, (double)count, strerror(errno) ));
+                       DEBUG(5, ("set_posix_lock_windows_flavour: Lock "
+                                 "fail !: Type = %s: offset = %ju, "
+                                 "count = %ju. Errno = %s\n",
+                                 posix_lock_type_name(posix_lock_type),
+                                 (uintmax_t)offset, (uintmax_t)count,
+                                 strerror(errno) ));
                        ret = False;
                        break;
                }
@@ -1064,14 +1053,17 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
                        offset = ll->start;
                        count = ll->size;
 
-                       DEBUG(5,("set_posix_lock_windows_flavour: Backing out locks: Type = %s: offset = %.0f, count = %.0f\n",
-                               posix_lock_type_name(posix_lock_type), (double)offset, (double)count ));
+                       DEBUG(5, ("set_posix_lock_windows_flavour: Backing "
+                                 "out locks: Type = %s: offset = %ju, "
+                                 "count = %ju\n",
+                                 posix_lock_type_name(posix_lock_type),
+                                 (uintmax_t)offset, (uintmax_t)count ));
 
-                       posix_fcntl_lock(fsp,SMB_F_SETLK,offset,count,F_UNLCK);
+                       posix_fcntl_lock(fsp,F_SETLK,offset,count,F_UNLCK);
                }
        } else {
-               /* Remember the number of Windows locks we have on this dev/ino pair. */
-               increment_windows_lock_ref_count(fsp);
+               /* Remember the number of locks we have on this dev/ino pair. */
+               increment_lock_ref_count(fsp);
        }
 
        talloc_destroy(l_ctx);
@@ -1091,19 +1083,19 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
                                const struct lock_struct *plocks,
                                int num_locks)
 {
-       SMB_OFF_T offset;
-       SMB_OFF_T count;
+       off_t offset;
+       off_t count;
        bool ret = True;
        TALLOC_CTX *ul_ctx = NULL;
        struct lock_list *ulist = NULL;
        struct lock_list *ul = NULL;
 
-       DEBUG(5,("release_posix_lock_windows_flavour: File %s, offset = %.0f, "
-                "count = %.0f\n", fsp_str_dbg(fsp),
-                (double)u_offset, (double)u_count));
+       DEBUG(5, ("release_posix_lock_windows_flavour: File %s, offset = %ju, "
+                 "count = %ju\n", fsp_str_dbg(fsp),
+                 (uintmax_t)u_offset, (uintmax_t)u_count));
 
-       /* Remember the number of Windows locks we have on this dev/ino pair. */
-       decrement_windows_lock_ref_count(fsp);
+       /* Remember the number of locks we have on this dev/ino pair. */
+       decrement_lock_ref_count(fsp);
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -1119,7 +1111,7 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
                return False;
        }
 
-       if ((ul = TALLOC_P(ul_ctx, struct lock_list)) == NULL) {
+       if ((ul = talloc(ul_ctx, struct lock_list)) == NULL) {
                DEBUG(0,("release_posix_lock_windows_flavour: unable to talloc unlock list.\n"));
                talloc_destroy(ul_ctx);
                return False;
@@ -1148,7 +1140,6 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
        ulist = posix_lock_list(ul_ctx,
                                ulist,
                                lock_ctx, /* Lock context ulist belongs to. */
-                               fsp,
                                plocks,
                                num_locks);
 
@@ -1163,10 +1154,11 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
        if (deleted_lock_type == WRITE_LOCK &&
                        (!ulist || ulist->next != NULL || ulist->start != offset || ulist->size != count)) {
 
-               DEBUG(5,("release_posix_lock_windows_flavour: downgrading lock to READ: offset = %.0f, count = %.0f\n",
-                       (double)offset, (double)count ));
+               DEBUG(5, ("release_posix_lock_windows_flavour: downgrading "
+                         "lock to READ: offset = %ju, count = %ju\n",
+                         (uintmax_t)offset, (uintmax_t)count ));
 
-               if (!posix_fcntl_lock(fsp,SMB_F_SETLK,offset,count,F_RDLCK)) {
+               if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,F_RDLCK)) {
                        DEBUG(0,("release_posix_lock_windows_flavour: downgrade of lock failed with error %s !\n", strerror(errno) ));
                        talloc_destroy(ul_ctx);
                        return False;
@@ -1181,10 +1173,11 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
                offset = ulist->start;
                count = ulist->size;
 
-               DEBUG(5,("release_posix_lock_windows_flavour: Real unlock: offset = %.0f, count = %.0f\n",
-                       (double)offset, (double)count ));
+               DEBUG(5, ("release_posix_lock_windows_flavour: Real unlock: "
+                         "offset = %ju, count = %ju\n",
+                         (uintmax_t)offset, (uintmax_t)count ));
 
-               if (!posix_fcntl_lock(fsp,SMB_F_SETLK,offset,count,F_UNLCK)) {
+               if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,F_UNLCK)) {
                        ret = False;
                }
        }
@@ -1198,6 +1191,86 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
  the underlying system POSIX locks.
 ****************************************************************************/
 
+/****************************************************************************
+ We only increment the lock ref count when we see a POSIX lock on a context
+ that doesn't already have them.
+****************************************************************************/
+
+static void increment_posix_lock_count(const files_struct *fsp,
+                                       uint64_t smblctx)
+{
+       NTSTATUS status;
+       TDB_DATA ctx_key;
+       TDB_DATA val = { 0 };
+
+       ctx_key.dptr = (uint8_t *)&smblctx;
+       ctx_key.dsize = sizeof(smblctx);
+
+       /*
+        * Don't increment if we already have any POSIX flavor
+        * locks on this context.
+        */
+       if (dbwrap_exists(posix_pending_close_db, ctx_key)) {
+               return;
+       }
+
+       /* Remember that we have POSIX flavor locks on this context. */
+       status = dbwrap_store(posix_pending_close_db, ctx_key, val, 0);
+       SMB_ASSERT(NT_STATUS_IS_OK(status));
+
+       increment_lock_ref_count(fsp);
+
+       DEBUG(10,("posix_locks set for file %s\n",
+               fsp_str_dbg(fsp)));
+}
+
+static void decrement_posix_lock_count(const files_struct *fsp, uint64_t smblctx)
+{
+       NTSTATUS status;
+       TDB_DATA ctx_key;
+
+       ctx_key.dptr = (uint8_t *)&smblctx;
+       ctx_key.dsize = sizeof(smblctx);
+
+       status = dbwrap_delete(posix_pending_close_db, ctx_key);
+       SMB_ASSERT(NT_STATUS_IS_OK(status));
+
+       decrement_lock_ref_count(fsp);
+
+       DEBUG(10,("posix_locks deleted for file %s\n",
+               fsp_str_dbg(fsp)));
+}
+
+/****************************************************************************
+ Return true if any locks exist on the given lock context.
+****************************************************************************/
+
+static bool locks_exist_on_context(const struct lock_struct *plocks,
+                               int num_locks,
+                               const struct lock_context *lock_ctx)
+{
+       int i;
+
+       for (i=0; i < num_locks; i++) {
+               const struct lock_struct *lock = &plocks[i];
+
+               /* Ignore all but read/write locks. */
+               if (lock->lock_type != READ_LOCK && lock->lock_type != WRITE_LOCK) {
+                       continue;
+               }
+
+               /* Ignore locks not owned by this process. */
+               if (!serverid_equal(&lock->context.pid, &lock_ctx->pid)) {
+                       continue;
+               }
+
+               if (lock_ctx->smblctx == lock->context.smblctx) {
+                       return true;
+               }
+       }
+       return false;
+}
+
 /****************************************************************************
  POSIX function to acquire a lock. Returns True if the
  lock could be granted, False if not.
@@ -1211,15 +1284,16 @@ bool set_posix_lock_posix_flavour(files_struct *fsp,
                        uint64_t u_offset,
                        uint64_t u_count,
                        enum brl_type lock_type,
+                       const struct lock_context *lock_ctx,
                        int *errno_ret)
 {
-       SMB_OFF_T offset;
-       SMB_OFF_T count;
+       off_t offset;
+       off_t count;
        int posix_lock_type = map_posix_lock_type(fsp,lock_type);
 
-       DEBUG(5,("set_posix_lock_posix_flavour: File %s, offset = %.0f, count "
-                "= %.0f, type = %s\n", fsp_str_dbg(fsp),
-                (double)u_offset, (double)u_count,
+       DEBUG(5,("set_posix_lock_posix_flavour: File %s, offset = %ju, count "
+                "= %ju, type = %s\n", fsp_str_dbg(fsp),
+                (uintmax_t)u_offset, (uintmax_t)u_count,
                 posix_lock_type_name(lock_type)));
 
        /*
@@ -1228,15 +1302,17 @@ bool set_posix_lock_posix_flavour(files_struct *fsp,
         */
 
        if(!posix_lock_in_range(&offset, &count, u_offset, u_count)) {
+               increment_posix_lock_count(fsp, lock_ctx->smblctx);
                return True;
        }
 
-       if (!posix_fcntl_lock(fsp,SMB_F_SETLK,offset,count,posix_lock_type)) {
+       if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,posix_lock_type)) {
                *errno_ret = errno;
-               DEBUG(5,("set_posix_lock_posix_flavour: Lock fail !: Type = %s: offset = %.0f, count = %.0f. Errno = %s\n",
-                       posix_lock_type_name(posix_lock_type), (double)offset, (double)count, strerror(errno) ));
+               DEBUG(5,("set_posix_lock_posix_flavour: Lock fail !: Type = %s: offset = %ju, count = %ju. Errno = %s\n",
+                       posix_lock_type_name(posix_lock_type), (intmax_t)offset, (intmax_t)count, strerror(errno) ));
                return False;
        }
+       increment_posix_lock_count(fsp, lock_ctx->smblctx);
        return True;
 }
 
@@ -1257,15 +1333,15 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
                                int num_locks)
 {
        bool ret = True;
-       SMB_OFF_T offset;
-       SMB_OFF_T count;
+       off_t offset;
+       off_t count;
        TALLOC_CTX *ul_ctx = NULL;
        struct lock_list *ulist = NULL;
        struct lock_list *ul = NULL;
 
-       DEBUG(5,("release_posix_lock_posix_flavour: File %s, offset = %.0f, "
-                "count = %.0f\n", fsp_str_dbg(fsp),
-                (double)u_offset, (double)u_count));
+       DEBUG(5, ("release_posix_lock_posix_flavour: File %s, offset = %ju, "
+                 "count = %ju\n", fsp_str_dbg(fsp),
+                 (uintmax_t)u_offset, (uintmax_t)u_count));
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -1273,6 +1349,9 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
         */
 
        if(!posix_lock_in_range(&offset, &count, u_offset, u_count)) {
+               if (!locks_exist_on_context(plocks, num_locks, lock_ctx)) {
+                       decrement_posix_lock_count(fsp, lock_ctx->smblctx);
+               }
                return True;
        }
 
@@ -1281,7 +1360,7 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
                return False;
        }
 
-       if ((ul = TALLOC_P(ul_ctx, struct lock_list)) == NULL) {
+       if ((ul = talloc(ul_ctx, struct lock_list)) == NULL) {
                DEBUG(0,("release_posix_lock_windows_flavour: unable to talloc unlock list.\n"));
                talloc_destroy(ul_ctx);
                return False;
@@ -1306,7 +1385,6 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
        ulist = posix_lock_list(ul_ctx,
                                ulist,
                                lock_ctx, /* Lock context ulist belongs to. */
-                               fsp,
                                plocks,
                                num_locks);
 
@@ -1318,14 +1396,18 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
                offset = ulist->start;
                count = ulist->size;
 
-               DEBUG(5,("release_posix_lock_posix_flavour: Real unlock: offset = %.0f, count = %.0f\n",
-                       (double)offset, (double)count ));
+               DEBUG(5, ("release_posix_lock_posix_flavour: Real unlock: "
+                         "offset = %ju, count = %ju\n",
+                         (uintmax_t)offset, (uintmax_t)count ));
 
-               if (!posix_fcntl_lock(fsp,SMB_F_SETLK,offset,count,F_UNLCK)) {
+               if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,F_UNLCK)) {
                        ret = False;
                }
        }
 
+       if (!locks_exist_on_context(plocks, num_locks, lock_ctx)) {
+               decrement_posix_lock_count(fsp, lock_ctx->smblctx);
+       }
        talloc_destroy(ul_ctx);
        return ret;
 }