smbd: Add mem_ctx to {f,}get_nt_acl VFS call

This makes it clear which context the returned SD is allocated on, as
a number of callers do not want it on talloc_tos().

As the ACL transformation allocates and then no longer needs a great
deal of memory, a talloc_stackframe() call is used to contain the
memory that is not returned further up the stack.

Andrew Bartlett

1 files changed, 10 insertions, 6 deletions

diff --git a/source3/modules/vfs_afsacl.c b/source3/modules/vfs_afsacl.c
index 770f6a33f01..96521bc2663 100644
--- a/source3/modules/vfs_afsacl.c
+++ b/source3/modules/vfs_afsacl.c
@@ -594,6 +594,7 @@ static uint32 nt_to_afs_file_rights(const char *filename, const struct security_
 static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
 				   SMB_STRUCT_STAT *psbuf,
 				   uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
 				   struct security_descriptor **ppdesc)
 {
 	struct security_ace *nt_ace_list;
@@ -601,7 +602,6 @@ static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
 	struct security_acl *psa = NULL;
 	int good_aces;
 	size_t sd_size;
-	TALLOC_CTX *mem_ctx = talloc_tos();
 
 	struct afs_ace *afs_ace;
 
@@ -663,6 +663,7 @@ static size_t afs_to_nt_acl(struct afs_acl *afs_acl,
 			    struct connection_struct *conn,
 			    struct smb_filename *smb_fname,
 			    uint32 security_info,
+			     TALLOC_CTX *mem_ctx,
 			    struct security_descriptor **ppdesc)
 {
 	int ret;
@@ -678,12 +679,13 @@ static size_t afs_to_nt_acl(struct afs_acl *afs_acl,
 	}
 
 	return afs_to_nt_acl_common(afs_acl, &smb_fname->st, security_info,
-				    ppdesc);
+				    mem_ctx, ppdesc);
 }
 
 static size_t afs_fto_nt_acl(struct afs_acl *afs_acl,
 			     struct files_struct *fsp,
 			     uint32 security_info,
+			     TALLOC_CTX *mem_ctx,
 			     struct security_descriptor **ppdesc)
 {
 	SMB_STRUCT_STAT sbuf;
@@ -691,7 +693,7 @@ static size_t afs_fto_nt_acl(struct afs_acl *afs_acl,
 	if (fsp->fh->fd == -1) {
 		/* Get the stat struct for the owner info. */
 		return afs_to_nt_acl(afs_acl, fsp->conn, fsp->fsp_name,
-				     security_info, ppdesc);
+				     security_info, mem_ctx, ppdesc);
 	}
 
 	if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
@@ -1008,6 +1010,7 @@ static NTSTATUS afs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 static NTSTATUS afsacl_fget_nt_acl(struct vfs_handle_struct *handle,
 				   struct files_struct *fsp,
 				   uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
 				   struct security_descriptor **ppdesc)
 {
 	struct afs_acl acl;
@@ -1021,7 +1024,7 @@ static NTSTATUS afsacl_fget_nt_acl(struct vfs_handle_struct *handle,
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	sd_size = afs_fto_nt_acl(&acl, fsp, security_info, ppdesc);
+	sd_size = afs_fto_nt_acl(&acl, fsp, security_info, mem_ctx, ppdesc);
 
 	free_afs_acl(&acl);
 
@@ -1029,7 +1032,8 @@ static NTSTATUS afsacl_fget_nt_acl(struct vfs_handle_struct *handle,
 }
 
 static NTSTATUS afsacl_get_nt_acl(struct vfs_handle_struct *handle,
-				  const char *name,  uint32 security_info,
+				  const char *name, uint32 security_info,
+				  TALLOC_CTX *mem_ctx,
 				  struct security_descriptor **ppdesc)
 {
 	struct afs_acl acl;
@@ -1053,7 +1057,7 @@ static NTSTATUS afsacl_get_nt_acl(struct vfs_handle_struct *handle,
 	}
 
 	sd_size = afs_to_nt_acl(&acl, handle->conn, smb_fname, security_info,
-				ppdesc);
+				mem_ctx, ppdesc);
 	TALLOC_FREE(smb_fname);
 
 	free_afs_acl(&acl);