CVE-2018-10919 security: Add more comments to the object-specific access checks
[vlendec/samba-autobuild/.git] / source3 / locking / posix.c
index 908cd57d5d810d4191df955f1d45f397d05c11e4..ff794282114af0186121f2d50c933495ec3fb51f 100644 (file)
@@ -23,6 +23,7 @@
 
 #include "includes.h"
 #include "system/filesys.h"
+#include "lib/util/server_id.h"
 #include "locking/proto.h"
 #include "dbwrap/dbwrap.h"
 #include "dbwrap/dbwrap_rbt.h"
@@ -114,7 +115,7 @@ static bool posix_lock_in_range(off_t *offset_out, off_t *count_out,
         * any Win32 locks of length zero. JRA.
         */
 
-       if (count == (off_t)0) {
+       if (count == 0) {
                DEBUG(10,("posix_lock_in_range: count = 0, ignoring.\n"));
                return False;
        }
@@ -125,8 +126,10 @@ static bool posix_lock_in_range(off_t *offset_out, off_t *count_out,
         */
 
        if (u_offset & ~((uint64_t)max_positive_lock_offset)) {
-               DEBUG(10,("posix_lock_in_range: (offset = %.0f) offset > %.0f and we cannot handle this. Ignoring lock.\n",
-                               (double)u_offset, (double)((uint64_t)max_positive_lock_offset) ));
+               DEBUG(10, ("posix_lock_in_range: (offset = %ju) offset > %ju "
+                          "and we cannot handle this. Ignoring lock.\n",
+                          (uintmax_t)u_offset,
+                          (uintmax_t)max_positive_lock_offset));
                return False;
        }
 
@@ -151,8 +154,10 @@ static bool posix_lock_in_range(off_t *offset_out, off_t *count_out,
         */
 
        if (count == 0) {
-               DEBUG(10,("posix_lock_in_range: Count = 0. Ignoring lock u_offset = %.0f, u_count = %.0f\n",
-                               (double)u_offset, (double)u_count ));
+               DEBUG(10, ("posix_lock_in_range: Count = 0. Ignoring lock "
+                          "u_offset = %ju, u_count = %ju\n",
+                          (uintmax_t)u_offset,
+                          (uintmax_t)u_count));
                return False;
        }
 
@@ -160,8 +165,9 @@ static bool posix_lock_in_range(off_t *offset_out, off_t *count_out,
         * The mapping was successful.
         */
 
-       DEBUG(10,("posix_lock_in_range: offset_out = %.0f, count_out = %.0f\n",
-                       (double)offset, (double)count ));
+       DEBUG(10, ("posix_lock_in_range: offset_out = %ju, "
+                  "count_out = %ju\n",
+                  (uintmax_t)offset, (uintmax_t)count));
 
        *offset_out = offset;
        *count_out = count;
@@ -193,10 +199,22 @@ static bool posix_fcntl_lock(files_struct *fsp, int op, off_t offset, off_t coun
 
        if (!ret && ((errno == EFBIG) || (errno == ENOLCK) || (errno ==  EINVAL))) {
 
-               DEBUG(0,("posix_fcntl_lock: WARNING: lock request at offset %.0f, length %.0f returned\n",
-                                       (double)offset,(double)count));
-               DEBUGADD(0,("an %s error. This can happen when using 64 bit lock offsets\n", strerror(errno)));
-               DEBUGADD(0,("on 32 bit NFS mounted file systems.\n"));
+               if ((errno == EINVAL) &&
+                               (op != F_GETLK &&
+                                op != F_SETLK &&
+                                op != F_SETLKW)) {
+                       DEBUG(0,("WARNING: OFD locks in use and no kernel "
+                               "support. Try setting "
+                               "'smbd:force process locks = true' "
+                               "in smb.conf\n"));
+               } else {
+                       DEBUG(0, ("WARNING: lock request at offset "
+                         "%ju, length %ju returned\n",
+                         (uintmax_t)offset, (uintmax_t)count));
+                       DEBUGADD(0, ("an %s error. This can happen when using 64 bit "
+                            "lock offsets\n", strerror(errno)));
+                       DEBUGADD(0, ("on 32 bit NFS mounted file systems.\n"));
+               }
 
                /*
                 * If the offset is > 0x7FFFFFFF then this will cause problems on
@@ -240,17 +258,20 @@ static bool posix_fcntl_getlock(files_struct *fsp, off_t *poffset, off_t *pcount
        pid_t pid;
        bool ret;
 
-       DEBUG(8,("posix_fcntl_getlock %d %.0f %.0f %d\n",
-               fsp->fh->fd,(double)*poffset,(double)*pcount,*ptype));
+       DEBUG(8, ("posix_fcntl_getlock %d %ju %ju %d\n",
+                 fsp->fh->fd, (uintmax_t)*poffset, (uintmax_t)*pcount,
+                 *ptype));
 
        ret = SMB_VFS_GETLOCK(fsp, poffset, pcount, ptype, &pid);
 
        if (!ret && ((errno == EFBIG) || (errno == ENOLCK) || (errno ==  EINVAL))) {
 
-               DEBUG(0,("posix_fcntl_getlock: WARNING: lock request at offset %.0f, length %.0f returned\n",
-                                       (double)*poffset,(double)*pcount));
-               DEBUGADD(0,("an %s error. This can happen when using 64 bit lock offsets\n", strerror(errno)));
-               DEBUGADD(0,("on 32 bit NFS mounted file systems.\n"));
+               DEBUG(0, ("posix_fcntl_getlock: WARNING: lock request at "
+                         "offset %ju, length %ju returned\n",
+                         (uintmax_t)*poffset, (uintmax_t)*pcount));
+               DEBUGADD(0, ("an %s error. This can happen when using 64 bit "
+                            "lock offsets\n", strerror(errno)));
+               DEBUGADD(0, ("on 32 bit NFS mounted file systems.\n"));
 
                /*
                 * If the offset is > 0x7FFFFFFF then this will cause problems on
@@ -290,9 +311,9 @@ bool is_posix_locked(files_struct *fsp,
        off_t count;
        int posix_lock_type = map_posix_lock_type(fsp,*plock_type);
 
-       DEBUG(10,("is_posix_locked: File %s, offset = %.0f, count = %.0f, "
-                 "type = %s\n", fsp_str_dbg(fsp), (double)*pu_offset,
-                 (double)*pu_count,  posix_lock_type_name(*plock_type)));
+       DEBUG(10, ("is_posix_locked: File %s, offset = %ju, count = %ju, "
+                  "type = %s\n", fsp_str_dbg(fsp), (uintmax_t)*pu_offset,
+                  (uintmax_t)*pu_count,  posix_lock_type_name(*plock_type)));
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -336,7 +357,7 @@ struct lock_ref_count_key {
  Form a static locking key for a dev/inode pair for the lock ref count
 ******************************************************************/
 
-static TDB_DATA locking_ref_count_key_fsp(files_struct *fsp,
+static TDB_DATA locking_ref_count_key_fsp(const files_struct *fsp,
                                          struct lock_ref_count_key *tmp)
 {
        ZERO_STRUCTP(tmp);
@@ -349,9 +370,9 @@ static TDB_DATA locking_ref_count_key_fsp(files_struct *fsp,
  Convenience function to get an fd_array key from an fsp.
 ******************************************************************/
 
-static TDB_DATA fd_array_key_fsp(files_struct *fsp)
+static TDB_DATA fd_array_key_fsp(const files_struct *fsp)
 {
-       return make_tdb_data((uint8 *)&fsp->file_id, sizeof(fsp->file_id));
+       return make_tdb_data((const uint8_t *)&fsp->file_id, sizeof(fsp->file_id));
 }
 
 /*******************************************************************
@@ -400,11 +421,11 @@ bool posix_locking_end(void)
 ****************************************************************************/
 
 /****************************************************************************
- Keep a reference count of the number of Windows locks open on this dev/ino
+ Keep a reference count of the number of locks open on this dev/ino
  pair. Creates entry if it doesn't exist.
 ****************************************************************************/
 
-static void increment_windows_lock_ref_count(files_struct *fsp)
+static void increment_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
        int32_t lock_ref_count = 0;
@@ -417,15 +438,11 @@ static void increment_windows_lock_ref_count(files_struct *fsp)
        SMB_ASSERT(NT_STATUS_IS_OK(status));
        SMB_ASSERT(lock_ref_count < INT32_MAX);
 
-       DEBUG(10,("increment_windows_lock_ref_count for file now %s = %d\n",
+       DEBUG(10,("lock_ref_count for file %s = %d\n",
                  fsp_str_dbg(fsp), (int)lock_ref_count));
 }
 
-/****************************************************************************
- Bulk delete - subtract as many locks as we've just deleted.
-****************************************************************************/
-
-static void decrement_windows_lock_ref_count(files_struct *fsp)
+static void decrement_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
        int32_t lock_ref_count = 0;
@@ -438,7 +455,7 @@ static void decrement_windows_lock_ref_count(files_struct *fsp)
        SMB_ASSERT(NT_STATUS_IS_OK(status));
        SMB_ASSERT(lock_ref_count >= 0);
 
-       DEBUG(10,("reduce_windows_lock_ref_count for file now %s = %d\n",
+       DEBUG(10,("lock_ref_count for file %s = %d\n",
                  fsp_str_dbg(fsp), (int)lock_ref_count));
 }
 
@@ -446,7 +463,7 @@ static void decrement_windows_lock_ref_count(files_struct *fsp)
  Fetch the lock ref count.
 ****************************************************************************/
 
-static int32_t get_windows_lock_ref_count(files_struct *fsp)
+static int32_t get_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
        NTSTATUS status;
@@ -458,7 +475,7 @@ static int32_t get_windows_lock_ref_count(files_struct *fsp)
 
        if (!NT_STATUS_IS_OK(status) &&
            !NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
-               DEBUG(0, ("get_windows_lock_ref_count: Error fetching "
+               DEBUG(0, ("Error fetching "
                          "lock ref count for file %s: %s\n",
                          fsp_str_dbg(fsp), nt_errstr(status)));
        }
@@ -469,7 +486,7 @@ static int32_t get_windows_lock_ref_count(files_struct *fsp)
  Delete a lock_ref_count entry.
 ****************************************************************************/
 
-static void delete_windows_lock_ref_count(files_struct *fsp)
+static void delete_lock_ref_count(const files_struct *fsp)
 {
        struct lock_ref_count_key tmp;
 
@@ -478,7 +495,7 @@ static void delete_windows_lock_ref_count(files_struct *fsp)
        dbwrap_delete(posix_pending_close_db,
                      locking_ref_count_key_fsp(fsp, &tmp));
 
-       DEBUG(10,("delete_windows_lock_ref_count for file %s\n",
+       DEBUG(10,("delete_lock_ref_count for file %s\n",
                  fsp_str_dbg(fsp)));
 }
 
@@ -486,7 +503,7 @@ static void delete_windows_lock_ref_count(files_struct *fsp)
  Add an fd to the pending close tdb.
 ****************************************************************************/
 
-static void add_fd_to_close_entry(files_struct *fsp)
+static void add_fd_to_close_entry(const files_struct *fsp)
 {
        struct db_record *rec;
        int *fds;
@@ -526,7 +543,7 @@ static void add_fd_to_close_entry(files_struct *fsp)
  Remove all fd entries for a specific dev/inode pair from the tdb.
 ****************************************************************************/
 
-static void delete_close_entries(files_struct *fsp)
+static void delete_close_entries(const files_struct *fsp)
 {
        struct db_record *rec;
 
@@ -545,7 +562,8 @@ static void delete_close_entries(files_struct *fsp)
 ****************************************************************************/
 
 static size_t get_posix_pending_close_entries(TALLOC_CTX *mem_ctx,
-                                             files_struct *fsp, int **entries)
+                                       const files_struct *fsp,
+                                       int **entries)
 {
        TDB_DATA dbuf;
        NTSTATUS status;
@@ -576,7 +594,7 @@ static size_t get_posix_pending_close_entries(TALLOC_CTX *mem_ctx,
  to delete all locks on this fsp before this function is called.
 ****************************************************************************/
 
-int fd_close_posix(struct files_struct *fsp)
+int fd_close_posix(const struct files_struct *fsp)
 {
        int saved_errno = 0;
        int ret;
@@ -584,17 +602,18 @@ int fd_close_posix(struct files_struct *fsp)
        size_t count, i;
 
        if (!lp_locking(fsp->conn->params) ||
-           !lp_posix_locking(fsp->conn->params))
+           !lp_posix_locking(fsp->conn->params) ||
+           fsp->use_ofd_locks)
        {
                /*
-                * No locking or POSIX to worry about or we want POSIX semantics
-                * which will lose all locks on all fd's open on this dev/inode,
-                * just close.
+                * No locking or POSIX to worry about or we are using POSIX
+                * open file description lock semantics which only removes
+                * locks on the file descriptor we're closing. Just close.
                 */
                return close(fsp->fh->fd);
        }
 
-       if (get_windows_lock_ref_count(fsp)) {
+       if (get_lock_ref_count(fsp)) {
 
                /*
                 * There are outstanding locks on this dev/inode pair on
@@ -634,7 +653,7 @@ int fd_close_posix(struct files_struct *fsp)
        TALLOC_FREE(fd_array);
 
        /* Don't need a lock ref count on this dev/ino anymore. */
-       delete_windows_lock_ref_count(fsp);
+       delete_lock_ref_count(fsp);
 
        /*
         * Finally close the fd associated with this fsp.
@@ -676,7 +695,6 @@ struct lock_list {
 static struct lock_list *posix_lock_list(TALLOC_CTX *ctx,
                                                struct lock_list *lhead,
                                                const struct lock_context *lock_ctx, /* Lock context lhead belongs to. */
-                                               files_struct *fsp,
                                                const struct lock_struct *plocks,
                                                int num_locks)
 {
@@ -687,8 +705,8 @@ static struct lock_list *posix_lock_list(TALLOC_CTX *ctx,
         * Quit if the list is deleted.
         */
 
-       DEBUG(10,("posix_lock_list: curr: start=%.0f,size=%.0f\n",
-               (double)lhead->start, (double)lhead->size ));
+       DEBUG(10, ("posix_lock_list: curr: start=%ju,size=%ju\n",
+                  (uintmax_t)lhead->start, (uintmax_t)lhead->size ));
 
        for (i=0; i<num_locks && lhead; i++) {
                const struct lock_struct *lock = &plocks[i];
@@ -712,9 +730,12 @@ static struct lock_list *posix_lock_list(TALLOC_CTX *ctx,
 
                for (l_curr = lhead; l_curr;) {
 
-                       DEBUG(10,("posix_lock_list: lock: fnum=%llu: start=%.0f,size=%.0f:type=%s",
-                               (unsigned long long)lock->fnum,
-                               (double)lock->start, (double)lock->size, posix_lock_type_name(lock->lock_type) ));
+                       DEBUG(10, ("posix_lock_list: lock: fnum=%ju: "
+                                  "start=%ju,size=%ju:type=%s",
+                                  (uintmax_t)lock->fnum,
+                                  (uintmax_t)lock->start,
+                                  (uintmax_t)lock->size,
+                                  posix_lock_type_name(lock->lock_type) ));
 
                        if ( (l_curr->start >= (lock->start + lock->size)) ||
                                 (lock->start >= (l_curr->start + l_curr->size))) {
@@ -788,8 +809,10 @@ BECOMES....
                                l_curr->size = (l_curr->start + l_curr->size) - (lock->start + lock->size);
                                l_curr->start = lock->start + lock->size;
 
-                               DEBUG(10,(" truncate high case: start=%.0f,size=%.0f\n",
-                                                               (double)l_curr->start, (double)l_curr->size ));
+                               DEBUG(10, (" truncate high case: start=%ju,"
+                                          "size=%ju\n",
+                                          (uintmax_t)l_curr->start,
+                                          (uintmax_t)l_curr->size ));
 
                                l_curr = l_curr->next;
 
@@ -816,8 +839,10 @@ BECOMES....
 
                                l_curr->size = lock->start - l_curr->start;
 
-                               DEBUG(10,(" truncate low case: start=%.0f,size=%.0f\n",
-                                                               (double)l_curr->start, (double)l_curr->size ));
+                               DEBUG(10, (" truncate low case: start=%ju,"
+                                          "size=%ju\n",
+                                          (uintmax_t)l_curr->start,
+                                          (uintmax_t)l_curr->size ));
 
                                l_curr = l_curr->next;
                
@@ -855,9 +880,13 @@ BECOMES.....
                                /* Truncate the l_curr. */
                                l_curr->size = lock->start - l_curr->start;
 
-                               DEBUG(10,(" split case: curr: start=%.0f,size=%.0f \
-new: start=%.0f,size=%.0f\n", (double)l_curr->start, (double)l_curr->size,
-                                                               (double)l_new->start, (double)l_new->size ));
+                               DEBUG(10, (" split case: curr: start=%ju,"
+                                          "size=%ju new: start=%ju,"
+                                          "size=%ju\n",
+                                          (uintmax_t)l_curr->start,
+                                          (uintmax_t)l_curr->size,
+                                          (uintmax_t)l_new->start,
+                                          (uintmax_t)l_new->size ));
 
                                /*
                                 * Add into the dlink list after the l_curr point - NOT at lhead. 
@@ -875,8 +904,14 @@ new: start=%.0f,size=%.0f\n", (double)l_curr->start, (double)l_curr->size,
                                 */
                                char *msg = NULL;
 
-                               if (asprintf(&msg, "logic flaw in cases: l_curr: start = %.0f, size = %.0f : \
-lock: start = %.0f, size = %.0f", (double)l_curr->start, (double)l_curr->size, (double)lock->start, (double)lock->size ) != -1) {
+                               if (asprintf(&msg, "logic flaw in cases: "
+                                            "l_curr: start = %ju, "
+                                            "size = %ju : lock: "
+                                            "start = %ju, size = %ju",
+                                            (uintmax_t)l_curr->start,
+                                            (uintmax_t)l_curr->size,
+                                            (uintmax_t)lock->start,
+                                            (uintmax_t)lock->size ) != -1) {
                                        smb_panic(msg);
                                } else {
                                        smb_panic("posix_lock_list");
@@ -911,10 +946,10 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
        struct lock_list *llist = NULL;
        struct lock_list *ll = NULL;
 
-       DEBUG(5,("set_posix_lock_windows_flavour: File %s, offset = %.0f, "
-                "count = %.0f, type = %s\n", fsp_str_dbg(fsp),
-                (double)u_offset, (double)u_count,
-                posix_lock_type_name(lock_type)));
+       DEBUG(5, ("set_posix_lock_windows_flavour: File %s, offset = %ju, "
+                 "count = %ju, type = %s\n", fsp_str_dbg(fsp),
+                 (uintmax_t)u_offset, (uintmax_t)u_count,
+                 posix_lock_type_name(lock_type)));
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -922,7 +957,7 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
         */
 
        if(!posix_lock_in_range(&offset, &count, u_offset, u_count)) {
-               increment_windows_lock_ref_count(fsp);
+               increment_lock_ref_count(fsp);
                return True;
        }
 
@@ -977,7 +1012,6 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
        llist = posix_lock_list(l_ctx,
                                llist,
                                lock_ctx, /* Lock context llist belongs to. */
-                               fsp,
                                plocks,
                                num_locks);
 
@@ -991,13 +1025,19 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
                offset = ll->start;
                count = ll->size;
 
-               DEBUG(5,("set_posix_lock_windows_flavour: Real lock: Type = %s: offset = %.0f, count = %.0f\n",
-                       posix_lock_type_name(posix_lock_type), (double)offset, (double)count ));
+               DEBUG(5, ("set_posix_lock_windows_flavour: Real lock: "
+                         "Type = %s: offset = %ju, count = %ju\n",
+                         posix_lock_type_name(posix_lock_type),
+                         (uintmax_t)offset, (uintmax_t)count ));
 
                if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,posix_lock_type)) {
                        *errno_ret = errno;
-                       DEBUG(5,("set_posix_lock_windows_flavour: Lock fail !: Type = %s: offset = %.0f, count = %.0f. Errno = %s\n",
-                               posix_lock_type_name(posix_lock_type), (double)offset, (double)count, strerror(errno) ));
+                       DEBUG(5, ("set_posix_lock_windows_flavour: Lock "
+                                 "fail !: Type = %s: offset = %ju, "
+                                 "count = %ju. Errno = %s\n",
+                                 posix_lock_type_name(posix_lock_type),
+                                 (uintmax_t)offset, (uintmax_t)count,
+                                 strerror(errno) ));
                        ret = False;
                        break;
                }
@@ -1013,14 +1053,17 @@ bool set_posix_lock_windows_flavour(files_struct *fsp,
                        offset = ll->start;
                        count = ll->size;
 
-                       DEBUG(5,("set_posix_lock_windows_flavour: Backing out locks: Type = %s: offset = %.0f, count = %.0f\n",
-                               posix_lock_type_name(posix_lock_type), (double)offset, (double)count ));
+                       DEBUG(5, ("set_posix_lock_windows_flavour: Backing "
+                                 "out locks: Type = %s: offset = %ju, "
+                                 "count = %ju\n",
+                                 posix_lock_type_name(posix_lock_type),
+                                 (uintmax_t)offset, (uintmax_t)count ));
 
                        posix_fcntl_lock(fsp,F_SETLK,offset,count,F_UNLCK);
                }
        } else {
-               /* Remember the number of Windows locks we have on this dev/ino pair. */
-               increment_windows_lock_ref_count(fsp);
+               /* Remember the number of locks we have on this dev/ino pair. */
+               increment_lock_ref_count(fsp);
        }
 
        talloc_destroy(l_ctx);
@@ -1047,12 +1090,12 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
        struct lock_list *ulist = NULL;
        struct lock_list *ul = NULL;
 
-       DEBUG(5,("release_posix_lock_windows_flavour: File %s, offset = %.0f, "
-                "count = %.0f\n", fsp_str_dbg(fsp),
-                (double)u_offset, (double)u_count));
+       DEBUG(5, ("release_posix_lock_windows_flavour: File %s, offset = %ju, "
+                 "count = %ju\n", fsp_str_dbg(fsp),
+                 (uintmax_t)u_offset, (uintmax_t)u_count));
 
-       /* Remember the number of Windows locks we have on this dev/ino pair. */
-       decrement_windows_lock_ref_count(fsp);
+       /* Remember the number of locks we have on this dev/ino pair. */
+       decrement_lock_ref_count(fsp);
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -1097,7 +1140,6 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
        ulist = posix_lock_list(ul_ctx,
                                ulist,
                                lock_ctx, /* Lock context ulist belongs to. */
-                               fsp,
                                plocks,
                                num_locks);
 
@@ -1112,8 +1154,9 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
        if (deleted_lock_type == WRITE_LOCK &&
                        (!ulist || ulist->next != NULL || ulist->start != offset || ulist->size != count)) {
 
-               DEBUG(5,("release_posix_lock_windows_flavour: downgrading lock to READ: offset = %.0f, count = %.0f\n",
-                       (double)offset, (double)count ));
+               DEBUG(5, ("release_posix_lock_windows_flavour: downgrading "
+                         "lock to READ: offset = %ju, count = %ju\n",
+                         (uintmax_t)offset, (uintmax_t)count ));
 
                if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,F_RDLCK)) {
                        DEBUG(0,("release_posix_lock_windows_flavour: downgrade of lock failed with error %s !\n", strerror(errno) ));
@@ -1130,8 +1173,9 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
                offset = ulist->start;
                count = ulist->size;
 
-               DEBUG(5,("release_posix_lock_windows_flavour: Real unlock: offset = %.0f, count = %.0f\n",
-                       (double)offset, (double)count ));
+               DEBUG(5, ("release_posix_lock_windows_flavour: Real unlock: "
+                         "offset = %ju, count = %ju\n",
+                         (uintmax_t)offset, (uintmax_t)count ));
 
                if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,F_UNLCK)) {
                        ret = False;
@@ -1147,6 +1191,86 @@ bool release_posix_lock_windows_flavour(files_struct *fsp,
  the underlying system POSIX locks.
 ****************************************************************************/
 
+/****************************************************************************
+ We only increment the lock ref count when we see a POSIX lock on a context
+ that doesn't already have them.
+****************************************************************************/
+
+static void increment_posix_lock_count(const files_struct *fsp,
+                                       uint64_t smblctx)
+{
+       NTSTATUS status;
+       TDB_DATA ctx_key;
+       TDB_DATA val = { 0 };
+
+       ctx_key.dptr = (uint8_t *)&smblctx;
+       ctx_key.dsize = sizeof(smblctx);
+
+       /*
+        * Don't increment if we already have any POSIX flavor
+        * locks on this context.
+        */
+       if (dbwrap_exists(posix_pending_close_db, ctx_key)) {
+               return;
+       }
+
+       /* Remember that we have POSIX flavor locks on this context. */
+       status = dbwrap_store(posix_pending_close_db, ctx_key, val, 0);
+       SMB_ASSERT(NT_STATUS_IS_OK(status));
+
+       increment_lock_ref_count(fsp);
+
+       DEBUG(10,("posix_locks set for file %s\n",
+               fsp_str_dbg(fsp)));
+}
+
+static void decrement_posix_lock_count(const files_struct *fsp, uint64_t smblctx)
+{
+       NTSTATUS status;
+       TDB_DATA ctx_key;
+
+       ctx_key.dptr = (uint8_t *)&smblctx;
+       ctx_key.dsize = sizeof(smblctx);
+
+       status = dbwrap_delete(posix_pending_close_db, ctx_key);
+       SMB_ASSERT(NT_STATUS_IS_OK(status));
+
+       decrement_lock_ref_count(fsp);
+
+       DEBUG(10,("posix_locks deleted for file %s\n",
+               fsp_str_dbg(fsp)));
+}
+
+/****************************************************************************
+ Return true if any locks exist on the given lock context.
+****************************************************************************/
+
+static bool locks_exist_on_context(const struct lock_struct *plocks,
+                               int num_locks,
+                               const struct lock_context *lock_ctx)
+{
+       int i;
+
+       for (i=0; i < num_locks; i++) {
+               const struct lock_struct *lock = &plocks[i];
+
+               /* Ignore all but read/write locks. */
+               if (lock->lock_type != READ_LOCK && lock->lock_type != WRITE_LOCK) {
+                       continue;
+               }
+
+               /* Ignore locks not owned by this process. */
+               if (!serverid_equal(&lock->context.pid, &lock_ctx->pid)) {
+                       continue;
+               }
+
+               if (lock_ctx->smblctx == lock->context.smblctx) {
+                       return true;
+               }
+       }
+       return false;
+}
+
 /****************************************************************************
  POSIX function to acquire a lock. Returns True if the
  lock could be granted, False if not.
@@ -1160,6 +1284,7 @@ bool set_posix_lock_posix_flavour(files_struct *fsp,
                        uint64_t u_offset,
                        uint64_t u_count,
                        enum brl_type lock_type,
+                       const struct lock_context *lock_ctx,
                        int *errno_ret)
 {
        off_t offset;
@@ -1177,6 +1302,7 @@ bool set_posix_lock_posix_flavour(files_struct *fsp,
         */
 
        if(!posix_lock_in_range(&offset, &count, u_offset, u_count)) {
+               increment_posix_lock_count(fsp, lock_ctx->smblctx);
                return True;
        }
 
@@ -1186,6 +1312,7 @@ bool set_posix_lock_posix_flavour(files_struct *fsp,
                        posix_lock_type_name(posix_lock_type), (intmax_t)offset, (intmax_t)count, strerror(errno) ));
                return False;
        }
+       increment_posix_lock_count(fsp, lock_ctx->smblctx);
        return True;
 }
 
@@ -1212,9 +1339,9 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
        struct lock_list *ulist = NULL;
        struct lock_list *ul = NULL;
 
-       DEBUG(5,("release_posix_lock_posix_flavour: File %s, offset = %.0f, "
-                "count = %.0f\n", fsp_str_dbg(fsp),
-                (double)u_offset, (double)u_count));
+       DEBUG(5, ("release_posix_lock_posix_flavour: File %s, offset = %ju, "
+                 "count = %ju\n", fsp_str_dbg(fsp),
+                 (uintmax_t)u_offset, (uintmax_t)u_count));
 
        /*
         * If the requested lock won't fit in the POSIX range, we will
@@ -1222,6 +1349,9 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
         */
 
        if(!posix_lock_in_range(&offset, &count, u_offset, u_count)) {
+               if (!locks_exist_on_context(plocks, num_locks, lock_ctx)) {
+                       decrement_posix_lock_count(fsp, lock_ctx->smblctx);
+               }
                return True;
        }
 
@@ -1255,7 +1385,6 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
        ulist = posix_lock_list(ul_ctx,
                                ulist,
                                lock_ctx, /* Lock context ulist belongs to. */
-                               fsp,
                                plocks,
                                num_locks);
 
@@ -1267,14 +1396,18 @@ bool release_posix_lock_posix_flavour(files_struct *fsp,
                offset = ulist->start;
                count = ulist->size;
 
-               DEBUG(5,("release_posix_lock_posix_flavour: Real unlock: offset = %.0f, count = %.0f\n",
-                       (double)offset, (double)count ));
+               DEBUG(5, ("release_posix_lock_posix_flavour: Real unlock: "
+                         "offset = %ju, count = %ju\n",
+                         (uintmax_t)offset, (uintmax_t)count ));
 
                if (!posix_fcntl_lock(fsp,F_SETLK,offset,count,F_UNLCK)) {
                        ret = False;
                }
        }
 
+       if (!locks_exist_on_context(plocks, num_locks, lock_ctx)) {
+               decrement_posix_lock_count(fsp, lock_ctx->smblctx);
+       }
        talloc_destroy(ul_ctx);
        return ret;
 }