Found whilst back-porting the fix for bug 8837 - smbd crashes when deleting directory...

The delete tokens are unique to each name hash representing a pathname,
if we don't correctly return here we'll add duplicate tokens for a
given pasname hash.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Sat Apr  7 02:13:58 CEST 2012 on sn-devel-104

diff --git a/source3/locking/locking.c b/source3/locking/locking.c
index cc921527272b9708c2801cfa370a9e0712d7ea4e..b9afd2392c46f973581e4d930cf8316837179b7c 100644 (file)
--- a/source3/locking/locking.c
+++ b/source3/locking/locking.c
@@ -934,16 +934,17 @@ void set_delete_on_close_lck(files_struct *fsp,
                                *dt = d->delete_tokens[
                                        d->num_delete_tokens-1];
                                d->num_delete_tokens -= 1;
-                               return;
+                       } else {
+                               /* Replace this token with the
+                                  given tok. */
+                               TALLOC_FREE(dt->delete_nt_token);
+                               dt->delete_nt_token = dup_nt_token(dt, nt_tok);
+                               SMB_ASSERT(dt->delete_nt_token != NULL);
+                               TALLOC_FREE(dt->delete_token);
+                               dt->delete_token = copy_unix_token(dt, tok);
+                               SMB_ASSERT(dt->delete_token != NULL);
                        }
-                       /* Replace this token with the
-                          given tok. */
-                       TALLOC_FREE(dt->delete_nt_token);
-                       dt->delete_nt_token = dup_nt_token(dt, nt_tok);
-                       SMB_ASSERT(dt->delete_nt_token != NULL);
-                       TALLOC_FREE(dt->delete_token);
-                       dt->delete_token = copy_unix_token(dt, tok);
-                       SMB_ASSERT(dt->delete_token != NULL);
+                       return;
                }
        }