torture3: Reproducer for bug 10593

We panic if we get an oplock break response for a cancelled create request

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Sat Jun 21 23:05:47 CEST 2014 on sn-devel-104

5 files changed, 168 insertions, 0 deletions

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 5cee5245a9..e529b3a1ac 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -68,6 +68,12 @@ for t in tests:
         plantestsuite("samba3.smbtorture_s3.crypt_server(s3dc).%s" % t, "s3dc", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmpenc', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
     plantestsuite("samba3.smbtorture_s3.plain(dc).%s" % t, "dc", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
 
+# non-crypt only
+
+tests = ["OPLOCK-CANCEL"]
+for t in tests:
+    plantestsuite("samba3.smbtorture_s3.plain(s3dc).%s" % t, "s3dc", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
+
 tests = ["RW1", "RW2", "RW3"]
 for t in tests:
     plantestsuite("samba3.smbtorture_s3.vfs_aio_fork(simpleserver).%s" % t, "simpleserver", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/vfs_aio_fork', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
diff --git a/source3/torture/proto.h b/source3/torture/proto.h
index 20c1110322..08790c758e 100644
--- a/source3/torture/proto.h
+++ b/source3/torture/proto.h
@@ -116,5 +116,6 @@ bool run_bench_pthreadpool(int dummy);
 bool run_messaging_read1(int dummy);
 bool run_messaging_read2(int dummy);
 bool run_messaging_read3(int dummy);
+bool run_oplock_cancel(int dummy);
 
 #endif /* __TORTURE_H__ */
diff --git a/source3/torture/test_oplock_cancel.c b/source3/torture/test_oplock_cancel.c
new file mode 100644
index 0000000000..aa4218a112
--- /dev/null
+++ b/source3/torture/test_oplock_cancel.c
@@ -0,0 +1,159 @@
+/*
+   Unix SMB/CIFS implementation.
+   Test cleanup behaviour
+   Copyright (C) Volker Lendecke 2011
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "locking/proto.h"
+#include "torture/proto.h"
+#include "system/filesys.h"
+#include "system/select.h"
+#include "libsmb/libsmb.h"
+#include "libcli/smb/smbXcli_base.h"
+#include "libcli/security/security.h"
+#include "lib/util/tevent_ntstatus.h"
+
+struct create_cancel_state {
+	uint8_t dummy;
+};
+
+static void create_cancel_done(struct tevent_req *subreq);
+
+static struct tevent_req *create_cancel_send(
+	TALLOC_CTX *mem_ctx, struct tevent_context *ev,
+	struct cli_state *cli, const char *fname)
+{
+	struct tevent_req *req, *subreq;
+	struct create_cancel_state *state;
+
+	req = tevent_req_create(mem_ctx, &state, struct create_cancel_state);
+	if (req == NULL) {
+		return NULL;
+	}
+
+	subreq = cli_ntcreate_send(
+		mem_ctx, ev, cli, fname, 0, FILE_GENERIC_READ,
+		FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ|FILE_SHARE_WRITE,
+		FILE_OPEN_IF, 0, 0);
+	if (tevent_req_nomem(subreq, req)) {
+		return tevent_req_post(req, ev);
+	}
+	if (!tevent_req_cancel(subreq)) {
+		tevent_req_oom(req);
+		return tevent_req_post(req, ev);
+	}
+	tevent_req_set_callback(subreq, create_cancel_done, req);
+	return req;
+}
+
+static void create_cancel_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req = tevent_req_callback_data(
+		subreq, struct tevent_req);
+	NTSTATUS status;
+
+	status = cli_ntcreate_recv(subreq, NULL, NULL);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_EQUAL(status, NT_STATUS_CANCELLED)) {
+		if (NT_STATUS_IS_OK(status)) {
+			status = NT_STATUS_UNSUCCESSFUL;
+		}
+		tevent_req_nterror(req, status);
+		return;
+	}
+	tevent_req_done(req);
+}
+
+static NTSTATUS create_cancel_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
+}
+
+static NTSTATUS create_cancel(struct cli_state *cli, const char *fname)
+{
+	TALLOC_CTX *frame = talloc_stackframe();
+	struct tevent_context *ev;
+	struct tevent_req *req;
+	NTSTATUS status = NT_STATUS_NO_MEMORY;
+
+	ev = samba_tevent_context_init(frame);
+	if (ev == NULL) {
+		goto fail;
+	}
+	req = create_cancel_send(frame, ev, cli, fname);
+	if (req == NULL) {
+		goto fail;
+	}
+	if (!tevent_req_poll_ntstatus(req, ev, &status)) {
+		goto fail;
+	}
+	status = create_cancel_recv(req);
+ fail:
+	TALLOC_FREE(frame);
+	return status;
+}
+
+bool run_oplock_cancel(int dummy)
+{
+	struct cli_state *cli1, *cli2;
+	const char *fname = "oplock-cancel";
+	uint16_t fnum1;
+	NTSTATUS status;
+
+	lp_set_cmdline("client max protocol", "smb3");
+
+	if (!torture_open_connection(&cli1, 0)) {
+		return false;
+	}
+	cli1->use_oplocks = true;
+
+	if (!torture_open_connection(&cli2, 0)) {
+		return false;
+	}
+	cli2->use_oplocks = true;
+
+	status = cli_ntcreate(
+		cli1, fname, 0, FILE_GENERIC_READ, FILE_ATTRIBUTE_NORMAL,
+		FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN_IF, 0, 0,
+		&fnum1, NULL);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("cli_ntcreate failed: %s\n", nt_errstr(status));
+		return false;
+	}
+
+	status = create_cancel(cli2, fname);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("create_cancel failed: %s\n", nt_errstr(status));
+		return false;
+	}
+
+	TALLOC_FREE(cli1);
+
+	/*
+	 * Give cli1's smbd time to inform cli2's smbd
+	 */
+	smb_msleep(5000);
+
+	status = cli_unlink(cli2, fname,
+			    FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_printf("cli_unlink failed: %s\n", nt_errstr(status));
+		return false;
+	}
+
+	return true;
+}
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index cea908930c..f5f8f86967 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -9596,6 +9596,7 @@ static struct {
 	{ "CLEANUP2", run_cleanup2 },
 	{ "CLEANUP3", run_cleanup3 },
 	{ "CLEANUP4", run_cleanup4 },
+	{ "OPLOCK-CANCEL", run_oplock_cancel },
 	{ "LOCAL-SUBSTITUTE", run_local_substitute, 0},
 	{ "LOCAL-GENCACHE", run_local_gencache, 0},
 	{ "LOCAL-TALLOC-DICT", run_local_talloc_dict, 0},
diff --git a/source3/wscript_build b/source3/wscript_build
index 5002f9363e..6f668bad37 100755
--- a/source3/wscript_build
+++ b/source3/wscript_build
@@ -1253,6 +1253,7 @@ bld.SAMBA3_BINARY('smbtorture' + bld.env.suffix3,
                  torture/test_dbwrap_ctdb.c
                  torture/test_buffersize.c
                  torture/test_messaging_read.c
+                 torture/test_oplock_cancel.c
                  torture/t_strappend.c
                  torture/bench_pthreadpool.c
                  torture/wbc_async.c''',