diff options
| author | Jeremy Allison <jra@samba.org> | 2014-05-01 10:58:51 -0700 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2014-05-02 21:27:07 +0200 |
| commit | bed323cebcfcf3298002ea8bc2eb6787419043b6 (patch) | |
| tree | d6dbb15b6524bc7ecadcb02ced90f9f804502df5 /source3/modules | |
| parent | e8a323c73138bc132e95facfae011847e7c14aa0 (diff) | |
| download | samba-bed323cebcfcf3298002ea8bc2eb6787419043b6.tar.gz samba-bed323cebcfcf3298002ea8bc2eb6787419043b6.tar.xz samba-bed323cebcfcf3298002ea8bc2eb6787419043b6.zip | |
s3 : smbd : Protect all possible code paths from fsp->op == NULL.
In changes to come this will be possible for an INTERNAL_OPEN_ONLY.
The protection was already in place for some code paths, this
makes the coverage compete.
Bug 10564 - Lock order violation and file lost
https://bugzilla.samba.org/show_bug.cgi?id=10564
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Diffstat (limited to 'source3/modules')
| -rw-r--r-- | source3/modules/vfs_btrfs.c | 5 | ||||
| -rw-r--r-- | source3/modules/vfs_default.c | 9 |
2 files changed, 14 insertions, 0 deletions
diff --git a/source3/modules/vfs_btrfs.c b/source3/modules/vfs_btrfs.c index 997a5de02f..c1e17b301e 100644 --- a/source3/modules/vfs_btrfs.c +++ b/source3/modules/vfs_btrfs.c @@ -116,6 +116,11 @@ static struct tevent_req *btrfs_copy_chunk_send(struct vfs_handle_struct *handle return tevent_req_post(req, ev); } + if (src_fsp->op == NULL || dest_fsp->op == NULL) { + tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR); + return tevent_req_post(req, ev); + } + init_strict_lock_struct(src_fsp, src_fsp->op->global->open_persistent_id, src_off, diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c index a129d81d43..06953573e6 100644 --- a/source3/modules/vfs_default.c +++ b/source3/modules/vfs_default.c @@ -1393,6 +1393,10 @@ static struct tevent_req *vfswrap_copy_chunk_send(struct vfs_handle_struct *hand off_t this_num = MIN(sizeof(vfs_cc_state->buf), num - vfs_cc_state->copied); + if (src_fsp->op == NULL) { + tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR); + return tevent_req_post(req, ev); + } init_strict_lock_struct(src_fsp, src_fsp->op->global->open_persistent_id, src_off, @@ -1426,6 +1430,11 @@ static struct tevent_req *vfswrap_copy_chunk_send(struct vfs_handle_struct *hand src_off += ret; + if (dest_fsp->op == NULL) { + tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR); + return tevent_req_post(req, ev); + } + init_strict_lock_struct(dest_fsp, dest_fsp->op->global->open_persistent_id, dest_off, |