Merge branch 'v3-2-test' of git://git.samba.org/samba into v3-2-test

(This used to be commit 3a61e663e51fe620225691bc8673bf8800a36f47)

10 files changed, 81 insertions, 94 deletions

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index c8175f77ac..9c25f69c97 100644
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -451,7 +451,6 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
 	int ret = 0;
 	files_struct *fsp = aio_ex->fsp;
 	char *outbuf = aio_ex->outbuf;
-	const char *inbuf = aio_ex->inbuf;
 	ssize_t numtowrite = aio_ex->acb.aio_nbytes;
 	ssize_t nwritten = SMB_VFS_AIO_RETURN(fsp,&aio_ex->acb);
 
diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index f67a4ad668..4c385d7611 100644
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -252,6 +252,7 @@ static NTSTATUS close_remove_share_mode(files_struct *fsp,
 
 		DEBUG(5,("close_remove_share_mode: file %s. "
 			"Change user to uid %u\n",
+			fsp->fsp_name,
 			(unsigned int)lck->delete_token->uid));
 
 		if (!push_sec_ctx()) {
diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c
index 04e3167e77..ca6f8bfd8d 100644
--- a/source3/smbd/dir.c
+++ b/source3/smbd/dir.c
@@ -142,8 +142,7 @@ static void dptr_idle(struct dptr_struct *dptr)
 {
 	if (dptr->dir_hnd) {
 		DEBUG(4,("Idling dptr dnum %d\n",dptr->dnum));
-		CloseDir(dptr->dir_hnd);
-		dptr->dir_hnd = NULL;
+		TALLOC_FREE(dptr->dir_hnd);
 	}
 }
 
@@ -192,7 +191,9 @@ static struct dptr_struct *dptr_get(int key, bool forclose)
 				if (dirhandles_open >= MAX_OPEN_DIRECTORIES)
 					dptr_idleoldest();
 				DEBUG(4,("dptr_get: Reopening dptr key %d\n",key));
-				if (!(dptr->dir_hnd = OpenDir(dptr->conn, dptr->path, dptr->wcard, dptr->attr))) {
+				if (!(dptr->dir_hnd = OpenDir(
+					      NULL, dptr->conn, dptr->path,
+					      dptr->wcard, dptr->attr))) {
 					DEBUG(4,("dptr_get: Failed to open %s (%s)\n",dptr->path,
 						strerror(errno)));
 					return False;
@@ -263,9 +264,7 @@ static void dptr_close_internal(struct dptr_struct *dptr)
 
 	bitmap_clear(dptr_bmap, dptr->dnum - 1);
 
-	if (dptr->dir_hnd) {
-		CloseDir(dptr->dir_hnd);
-	}
+	TALLOC_FREE(dptr->dir_hnd);
 
 	/* Lanman 2 specific code */
 	SAFE_FREE(dptr->wcard);
@@ -411,7 +410,7 @@ NTSTATUS dptr_create(connection_struct *conn, const char *path, bool old_handle,
 		return status;
 	}
 
-	dir_hnd = OpenDir(conn, path, wcard, attr);
+	dir_hnd = OpenDir(NULL, conn, path, wcard, attr);
 	if (!dir_hnd) {
 		return map_nt_error_from_unix(errno);
 	}
@@ -425,7 +424,7 @@ NTSTATUS dptr_create(connection_struct *conn, const char *path, bool old_handle,
 	dptr = SMB_MALLOC_P(struct dptr_struct);
 	if(!dptr) {
 		DEBUG(0,("malloc fail in dptr_create.\n"));
-		CloseDir(dir_hnd);
+		TALLOC_FREE(dir_hnd);
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -455,7 +454,7 @@ NTSTATUS dptr_create(connection_struct *conn, const char *path, bool old_handle,
 			if(dptr->dnum == -1 || dptr->dnum > 254) {
 				DEBUG(0,("dptr_create: returned %d: Error - all old dirptrs in use ?\n", dptr->dnum));
 				SAFE_FREE(dptr);
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				return NT_STATUS_TOO_MANY_OPENED_FILES;
 			}
 		}
@@ -485,7 +484,7 @@ NTSTATUS dptr_create(connection_struct *conn, const char *path, bool old_handle,
 			if(dptr->dnum == -1 || dptr->dnum < 255) {
 				DEBUG(0,("dptr_create: returned %d: Error - all new dirptrs in use ?\n", dptr->dnum));
 				SAFE_FREE(dptr);
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				return NT_STATUS_TOO_MANY_OPENED_FILES;
 			}
 		}
@@ -504,7 +503,7 @@ NTSTATUS dptr_create(connection_struct *conn, const char *path, bool old_handle,
 	if (!dptr->wcard) {
 		bitmap_clear(dptr_bmap, dptr->dnum - 1);
 		SAFE_FREE(dptr);
-		CloseDir(dir_hnd);
+		TALLOC_FREE(dir_hnd);
 		return NT_STATUS_NO_MEMORY;
 	}
 	if (lp_posix_pathnames() || (wcard[0] == '.' && wcard[1] == 0)) {
@@ -533,7 +532,8 @@ NTSTATUS dptr_create(connection_struct *conn, const char *path, bool old_handle,
 int dptr_CloseDir(struct dptr_struct *dptr)
 {
 	DLIST_REMOVE(dirptrs, dptr);
-	return CloseDir(dptr->dir_hnd);
+	TALLOC_FREE(dptr->dir_hnd);
+	return 0;
 }
 
 void dptr_SeekDir(struct dptr_struct *dptr, long offset)
@@ -1113,72 +1113,53 @@ bool is_visible_file(connection_struct *conn, const char *dir_path, const char *
 	return True;
 }
 
+static int smb_Dir_destructor(struct smb_Dir *dirp)
+{
+	if (dirp->dir) {
+		SMB_VFS_CLOSEDIR(dirp->conn,dirp->dir);
+	}
+	dirhandles_open--;
+	return 0;
+}
+
 /*******************************************************************
  Open a directory.
 ********************************************************************/
 
-struct smb_Dir *OpenDir(connection_struct *conn, const char *name, const char *mask, uint32 attr)
+struct smb_Dir *OpenDir(TALLOC_CTX *mem_ctx, connection_struct *conn,
+			const char *name, const char *mask, uint32 attr)
 {
-	struct smb_Dir *dirp = SMB_MALLOC_P(struct smb_Dir);
+	struct smb_Dir *dirp = TALLOC_ZERO_P(mem_ctx, struct smb_Dir);
 
 	if (!dirp) {
 		return NULL;
 	}
-	ZERO_STRUCTP(dirp);
 
 	dirp->conn = conn;
 	dirp->name_cache_size = lp_directory_name_cache_size(SNUM(conn));
 
-	dirp->dir_path = SMB_STRDUP(name);
+	dirp->dir_path = talloc_strdup(dirp, name);
 	if (!dirp->dir_path) {
 		goto fail;
 	}
+
+	dirhandles_open++;
+	talloc_set_destructor(dirp, smb_Dir_destructor);
+
 	dirp->dir = SMB_VFS_OPENDIR(conn, dirp->dir_path, mask, attr);
 	if (!dirp->dir) {
-		DEBUG(5,("OpenDir: Can't open %s. %s\n", dirp->dir_path, strerror(errno) ));
+		DEBUG(5,("OpenDir: Can't open %s. %s\n", dirp->dir_path,
+			 strerror(errno) ));
 		goto fail;
 	}
 
-	dirhandles_open++;
 	return dirp;
 
   fail:
-
-	if (dirp) {
-		if (dirp->dir) {
-			SMB_VFS_CLOSEDIR(conn,dirp->dir);
-		}
-		SAFE_FREE(dirp->dir_path);
-		SAFE_FREE(dirp->name_cache);
-		SAFE_FREE(dirp);
-	}
+	TALLOC_FREE(dirp);
 	return NULL;
 }
 
-
-/*******************************************************************
- Close a directory.
-********************************************************************/
-
-int CloseDir(struct smb_Dir *dirp)
-{
-	int i, ret = 0;
-
-	if (dirp->dir) {
-		ret = SMB_VFS_CLOSEDIR(dirp->conn,dirp->dir);
-	}
-	SAFE_FREE(dirp->dir_path);
-	if (dirp->name_cache) {
-		for (i = 0; i < dirp->name_cache_size; i++) {
-			SAFE_FREE(dirp->name_cache[i].name);
-		}
-	}
-	SAFE_FREE(dirp->name_cache);
-	SAFE_FREE(dirp);
-	dirhandles_open--;
-	return ret;
-}
-
 /*******************************************************************
  Read from a directory. Also return current offset.
  Don't check for veto or invisible files.
@@ -1290,8 +1271,8 @@ void DirCacheAdd(struct smb_Dir *dirp, const char *name, long offset)
 	}
 
 	if (dirp->name_cache == NULL) {
-		dirp->name_cache = SMB_CALLOC_ARRAY(struct name_cache_entry,
-						    dirp->name_cache_size);
+		dirp->name_cache = TALLOC_ZERO_ARRAY(
+			dirp, struct name_cache_entry, dirp->name_cache_size);
 
 		if (dirp->name_cache == NULL) {
 			return;
@@ -1301,8 +1282,8 @@ void DirCacheAdd(struct smb_Dir *dirp, const char *name, long offset)
 	dirp->name_cache_index = (dirp->name_cache_index+1) %
 					dirp->name_cache_size;
 	e = &dirp->name_cache[dirp->name_cache_index];
-	SAFE_FREE(e->name);
-	e->name = SMB_STRDUP(name);
+	TALLOC_FREE(e->name);
+	e->name = talloc_strdup(dirp, name);
 	e->offset = offset;
 }
 
@@ -1359,7 +1340,8 @@ NTSTATUS can_delete_directory(struct connection_struct *conn,
 	NTSTATUS status = NT_STATUS_OK;
 	long dirpos = 0;
 	const char *dname;
-	struct smb_Dir *dir_hnd = OpenDir(conn, dirname, NULL, 0);
+	struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, dirname,
+					  NULL, 0);
 
 	if (!dir_hnd) {
 		return map_nt_error_from_unix(errno);
@@ -1383,7 +1365,7 @@ NTSTATUS can_delete_directory(struct connection_struct *conn,
 		status = NT_STATUS_DIRECTORY_NOT_EMPTY;
 		break;
 	}
-	CloseDir(dir_hnd);
+	TALLOC_FREE(dir_hnd);
 
 	return status;
 }
diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c
index 5ae193fb46..be4960cab8 100644
--- a/source3/smbd/filename.c
+++ b/source3/smbd/filename.c
@@ -778,7 +778,7 @@ static bool scan_directory(connection_struct *conn, const char *path,
 	}
 
 	/* open the directory */
-	if (!(cur_dir = OpenDir(conn, path, NULL, 0))) {
+	if (!(cur_dir = OpenDir(talloc_tos(), conn, path, NULL, 0))) {
 		DEBUG(3,("scan dir didn't open dir [%s]\n",path));
 		TALLOC_FREE(unmangled_name);
 		return(False);
@@ -809,7 +809,7 @@ static bool scan_directory(connection_struct *conn, const char *path,
 			/* we've found the file, change it's name and return */
 			*found_name = talloc_strdup(ctx,dname);
 			TALLOC_FREE(unmangled_name);
-			CloseDir(cur_dir);
+			TALLOC_FREE(cur_dir);
 			if (!*found_name) {
 				errno = ENOMEM;
 				return False;
@@ -819,7 +819,7 @@ static bool scan_directory(connection_struct *conn, const char *path,
 	}
 
 	TALLOC_FREE(unmangled_name);
-	CloseDir(cur_dir);
+	TALLOC_FREE(cur_dir);
 	errno = ENOENT;
 	return False;
 }
diff --git a/source3/smbd/mangle_hash2.c b/source3/smbd/mangle_hash2.c
index 9643506aea..a9b94aabc3 100644
--- a/source3/smbd/mangle_hash2.c
+++ b/source3/smbd/mangle_hash2.c
@@ -396,7 +396,7 @@ static bool lookup_name_from_8_3(TALLOC_CTX *ctx,
 
 	TALLOC_FREE(prefix);
 
-	if (!pp_out) {
+	if (!*pp_out) {
 		M_DEBUG(0,("talloc_fail"));
 		return False;
 	}
diff --git a/source3/smbd/notify.c b/source3/smbd/notify.c
index 5c26cac219..55009ce0b1 100644
--- a/source3/smbd/notify.c
+++ b/source3/smbd/notify.c
@@ -235,6 +235,7 @@ NTSTATUS change_notify_create(struct files_struct *fsp, uint32 filter,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+	ZERO_STRUCT(e);
 	e.path = fullpath;
 	e.filter = filter;
 	e.subdir_filter = 0;
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 59699dfbd0..9d48bcc98b 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -598,12 +598,6 @@ static NTSTATUS open_mode_check(connection_struct *conn,
 	}
 
 	*file_existed = True;
-	
-	if (is_stat_open(access_mask)) {
-		/* Stat open that doesn't trigger oplock breaks or share mode
-		 * checks... ! JRA. */
-		return NT_STATUS_OK;
-	}
 
 	/* A delete on close prohibits everything */
 
@@ -611,6 +605,12 @@ static NTSTATUS open_mode_check(connection_struct *conn,
 		return NT_STATUS_DELETE_PENDING;
 	}
 
+	if (is_stat_open(access_mask)) {
+		/* Stat open that doesn't trigger oplock breaks or share mode
+		 * checks... ! JRA. */
+		return NT_STATUS_OK;
+	}
+
 	/*
 	 * Check if the share modes will give us access.
 	 */
@@ -1761,14 +1761,16 @@ NTSTATUS open_file_ntcreate(connection_struct *conn,
            the kernel refuses the operations then the kernel is wrong.
 	   note that GPFS supports it as well - jmcd */
 
-	ret_flock = SMB_VFS_KERNEL_FLOCK(fsp, share_access);
-	if(ret_flock == -1 ){
+	if (fsp->fh->fd != -1) {
+		ret_flock = SMB_VFS_KERNEL_FLOCK(fsp, share_access);
+		if(ret_flock == -1 ){
 
-		TALLOC_FREE(lck);
-		fd_close(fsp);
-		file_free(fsp);
-		
-		return NT_STATUS_SHARING_VIOLATION;
+			TALLOC_FREE(lck);
+			fd_close(fsp);
+			file_free(fsp);
+
+			return NT_STATUS_SHARING_VIOLATION;
+		}
 	}
 
 	/*
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 2d3cf7fbd8..a5bdb96650 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -2085,7 +2085,7 @@ void smbd_process(void)
 
 		run_events(smbd_event_context(), 0, NULL, NULL);
 
-		while (!receive_message_or_smb(NULL, &inbuf, &inbuf_len,
+		while (!receive_message_or_smb(talloc_tos(), &inbuf, &inbuf_len,
 						select_timeout,
 						&unread_bytes,
 						&encrypted)) {
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 8149f5aeb6..e2316ef120 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -2410,7 +2410,8 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
 			return status;
 		}
 
-		dir_hnd = OpenDir(conn, directory, mask, dirtype);
+		dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
+				  dirtype);
 		if (dir_hnd == NULL) {
 			return map_nt_error_from_unix(errno);
 		}
@@ -2448,7 +2449,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
 
 			status = check_name(conn, fname);
 			if (!NT_STATUS_IS_OK(status)) {
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				return status;
 			}
 
@@ -2464,7 +2465,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
 
 			TALLOC_FREE(fname);
 		}
-		CloseDir(dir_hnd);
+		TALLOC_FREE(dir_hnd);
 	}
 
 	if (count == 0 && NT_STATUS_IS_OK(status)) {
@@ -4901,7 +4902,8 @@ static bool recursive_rmdir(TALLOC_CTX *ctx,
 	const char *dname = NULL;
 	bool ret = True;
 	long offset = 0;
-	struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
+	struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
+					  NULL, 0);
 
 	if(dir_hnd == NULL)
 		return False;
@@ -4949,7 +4951,7 @@ static bool recursive_rmdir(TALLOC_CTX *ctx,
 		}
 		TALLOC_FREE(fullname);
 	}
-	CloseDir(dir_hnd);
+	TALLOC_FREE(dir_hnd);
 	return ret;
 }
 
@@ -4997,7 +4999,8 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
 		 */
 		const char *dname;
 		long dirpos = 0;
-		struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
+		struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
+						  directory, NULL, 0);
 
 		if(dir_hnd == NULL) {
 			errno = ENOTEMPTY;
@@ -5010,7 +5013,7 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
 			if (!is_visible_file(conn, directory, dname, &st, False))
 				continue;
 			if(!IS_VETO_PATH(conn, dname)) {
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				errno = ENOTEMPTY;
 				goto err;
 			}
@@ -5055,7 +5058,7 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
 			}
 			TALLOC_FREE(fullname);
 		}
-		CloseDir(dir_hnd);
+		TALLOC_FREE(dir_hnd);
 		/* Retry the rmdir */
 		ret = SMB_VFS_RMDIR(conn,directory);
 	}
@@ -5751,7 +5754,7 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
 		return status;
 	}
 
-	dir_hnd = OpenDir(conn, directory, mask, attrs);
+	dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
 	if (dir_hnd == NULL) {
 		return map_nt_error_from_unix(errno);
 	}
@@ -5851,7 +5854,7 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
 		TALLOC_FREE(fname);
 		TALLOC_FREE(destname);
 	}
-	CloseDir(dir_hnd);
+	TALLOC_FREE(dir_hnd);
 
 	if (count == 0 && NT_STATUS_IS_OK(status)) {
 		status = map_nt_error_from_unix(errno);
@@ -6325,7 +6328,7 @@ void reply_copy(struct smb_request *req)
 			return;
 		}
 
-		dir_hnd = OpenDir(conn, directory, mask, 0);
+		dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
 		if (dir_hnd == NULL) {
 			status = map_nt_error_from_unix(errno);
 			reply_nterror(req, status);
@@ -6357,7 +6360,7 @@ void reply_copy(struct smb_request *req)
 					directory,
 					dname);
 			if (!fname) {
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				reply_nterror(req, NT_STATUS_NO_MEMORY);
 				END_PROFILE(SMBcopy);
 				return;
@@ -6368,7 +6371,7 @@ void reply_copy(struct smb_request *req)
 				continue;
 			}
 			if (!destname) {
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				reply_nterror(req, NT_STATUS_NO_MEMORY);
 				END_PROFILE(SMBcopy);
 				return;
@@ -6376,7 +6379,7 @@ void reply_copy(struct smb_request *req)
 
 			status = check_name(conn, fname);
 			if (!NT_STATUS_IS_OK(status)) {
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				reply_nterror(req, status);
 				END_PROFILE(SMBcopy);
 				return;
@@ -6384,7 +6387,7 @@ void reply_copy(struct smb_request *req)
 
 			status = check_name(conn, destname);
 			if (!NT_STATUS_IS_OK(status)) {
-				CloseDir(dir_hnd);
+				TALLOC_FREE(dir_hnd);
 				reply_nterror(req, status);
 				END_PROFILE(SMBcopy);
 				return;
@@ -6400,7 +6403,7 @@ void reply_copy(struct smb_request *req)
 			TALLOC_FREE(fname);
 			TALLOC_FREE(destname);
 		}
-		CloseDir(dir_hnd);
+		TALLOC_FREE(dir_hnd);
 	}
 
 	if (count == 0) {
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index bc1d26faca..aee8e498e9 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -259,7 +259,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
 	fstring user;
 	int sess_vuid = req->vuid;
 	NTSTATUS ret = NT_STATUS_OK;
-	PAC_DATA *pac_data;
+	PAC_DATA *pac_data = NULL;
 	DATA_BLOB ap_rep, ap_rep_wrapped, response;
 	auth_serversupplied_info *server_info = NULL;
 	DATA_BLOB session_key = data_blob_null;
@@ -271,7 +271,6 @@ static void reply_spnego_kerberos(struct smb_request *req,
 	PAC_LOGON_INFO *logon_info = NULL;
 
 	ZERO_STRUCT(ticket);
-	ZERO_STRUCT(pac_data);
 	ZERO_STRUCT(ap_rep);
 	ZERO_STRUCT(ap_rep_wrapped);
 	ZERO_STRUCT(response);