Ok - this is more subtle than it looks :-).

When a file is being closed, once it passes the fnum and tid tests then
the locking context should be ignored when removing all locks. This is
what is done in the brl close case, but when you have outstanding
POSIX locks, then you cannot remove all the brl locks in one go, you
have to get the lock list and call do_unlock individually. As this
uses global_smbpid as the locking context, you need to make sure
that this is set correctly for the specific lock being removed. I
now do this by storing the smbpid in each entry in the unlock list returned from
the query call. I removed the smbpid from fsp (not needed) and
things seem ok (even with the stupid smbpid tricks that smbtorture plays :-).

Jeremy.

5 files changed, 17 insertions, 13 deletions

diff --git a/source/include/smb.h b/source/include/smb.h
index e4415e7d220..78d17aaa3d4 100644
--- a/source/include/smb.h
+++ b/source/include/smb.h
@@ -482,7 +482,6 @@ typedef struct files_struct
 	SMB_OFF_T size;
 	mode_t mode;
 	uint16 vuid;
-	int smbpid;
 	write_bmpx_struct *wbmpx_ptr;
 	write_cache *wcp;
 	struct timeval open_time;
@@ -527,6 +526,7 @@ struct unlock_list {
 	struct unlock_list *prev;
 	SMB_BIG_UINT start;
 	SMB_BIG_UINT size;
+	uint16 smbpid;
 };
 
 typedef struct
diff --git a/source/locking/brlock.c b/source/locking/brlock.c
index ed1f73df5ed..410fb3fc0bd 100644
--- a/source/locking/brlock.c
+++ b/source/locking/brlock.c
@@ -367,6 +367,7 @@ BECOMES.....
 				ZERO_STRUCTP(ul_new);
 				ul_new->start = lock->start + lock->size;
 				ul_new->size = ul_curr->start + ul_curr->size - ul_new->start;
+				ul_new->smbpid = ul_curr->smbpid;
 
 				/* Add into the dlink list after the ul_curr point - NOT at ulhead. */
 				DLIST_ADD(ul_curr, ul_new);
@@ -638,6 +639,7 @@ struct unlock_list *brl_getlocklist( TALLOC_CTX *ctx, SMB_DEV_T dev, SMB_INO_T i
 				ZERO_STRUCTP(ul_new);
 				ul_new->start = lock->start;
 				ul_new->size = lock->size;
+				ul_new->smbpid = lock->context.smbpid;
 
 				DLIST_ADD(ulist, ul_new);
 		}
diff --git a/source/locking/locking.c b/source/locking/locking.c
index b6b34138e36..088693b6d42 100644
--- a/source/locking/locking.c
+++ b/source/locking/locking.c
@@ -37,6 +37,7 @@
 
 #include "includes.h"
 extern int DEBUGLEVEL;
+int global_smbpid;
 
 /* the locking database handle */
 static TDB_CONTEXT *tdb;
@@ -567,7 +568,7 @@ BOOL is_locked(files_struct *fsp,connection_struct *conn,
 		return(False);
 
 	ret = !brl_locktest(fsp->dev, fsp->inode, 
-			     fsp->smbpid, getpid(), conn->cnum, 
+			     global_smbpid, getpid(), conn->cnum, 
 			     offset, count, lock_type);
 
 	/*
@@ -605,7 +606,7 @@ BOOL do_lock(files_struct *fsp,connection_struct *conn,
 
 	if (OPEN_FSP(fsp) && fsp->can_lock && (fsp->conn == conn)) {
 		ok = brl_lock(fsp->dev, fsp->inode, fsp->fnum,
-			      fsp->smbpid, getpid(), conn->cnum, 
+			      global_smbpid, getpid(), conn->cnum, 
 			      offset, count, 
 			      lock_type);
 
@@ -625,7 +626,7 @@ BOOL do_lock(files_struct *fsp,connection_struct *conn,
 				 * lock entry.
 				 */
 				(void)brl_unlock(fsp->dev, fsp->inode, fsp->fnum,
-								fsp->smbpid, getpid(), conn->cnum, 
+								global_smbpid, getpid(), conn->cnum, 
 								offset, count);
 			}
 		}
@@ -674,7 +675,7 @@ BOOL do_unlock(files_struct *fsp,connection_struct *conn,
 	pid = getpid();
 
 	ok = brl_unlock(fsp->dev, fsp->inode, fsp->fnum,
-			fsp->smbpid, pid, conn->cnum, offset, count);
+			global_smbpid, pid, conn->cnum, offset, count);
    
 	if (!ok) {
 		DEBUG(10,("do_unlock: returning ERRlock.\n" ));
@@ -705,6 +706,7 @@ BOOL do_unlock(files_struct *fsp,connection_struct *conn,
 	ZERO_STRUCTP(ul);
 	ul->start = offset;
 	ul->size = count;
+	ul->smbpid = global_smbpid;
 
 	DLIST_ADD(ulist, ul);
 
@@ -770,12 +772,16 @@ void locking_close_file(files_struct *fsp)
 
 		/*
 		 * Now unlock all of them. This will remove the brl entry also
-		 * for each lock.
+		 * for each lock. Note we need to make sure the global_smbpid matches
+		 * the one associated with each lock in case the client plays games
+		 * with smbpids (like smbtorture does :-).
 		 */
 
-		for(; ul; ul = ul->next)
+		for(; ul; ul = ul->next) {
+			global_smbpid = ul->smbpid;
 			do_unlock(fsp,fsp->conn,ul->size,ul->start,&eclass,&ecode);
-		
+		}
+	
 		talloc_destroy(ul_ctx);
 
 	} else {
diff --git a/source/smbd/open.c b/source/smbd/open.c
index 92bba76619a..737b9b5ef36 100644
--- a/source/smbd/open.c
+++ b/source/smbd/open.c
@@ -26,7 +26,6 @@ extern int DEBUGLEVEL;
 extern pstring sesssetup_user;
 extern uint16 global_oplock_port;
 extern BOOL global_client_failed_oplock_break;
-extern int global_smbpid;
 
 /****************************************************************************
  fd support routines - attempt to do a dos_open.
@@ -165,7 +164,6 @@ static BOOL open_file(files_struct *fsp,connection_struct *conn,
 	fsp->dev = sbuf.st_dev;
 	GetTimeOfDay(&fsp->open_time);
 	fsp->vuid = current_user.vuid;
-	fsp->smbpid = global_smbpid;
 	fsp->size = 0;
 	fsp->pos = -1;
 	fsp->can_lock = True;
@@ -799,7 +797,6 @@ files_struct *open_file_stat(connection_struct *conn,
 	fsp->mode = 0;
 	GetTimeOfDay(&fsp->open_time);
 	fsp->vuid = current_user.vuid;
-	fsp->smbpid = global_smbpid;
 	fsp->size = 0;
 	fsp->pos = -1;
 	fsp->can_lock = False;
@@ -923,7 +920,6 @@ files_struct *open_directory(connection_struct *conn,
 	fsp->mode = 0;
 	GetTimeOfDay(&fsp->open_time);
 	fsp->vuid = current_user.vuid;
-	fsp->smbpid = global_smbpid;
 	fsp->size = 0;
 	fsp->pos = -1;
 	fsp->can_lock = True;
diff --git a/source/smbd/process.c b/source/smbd/process.c
index 77e6fc2aa79..f3785502829 100644
--- a/source/smbd/process.c
+++ b/source/smbd/process.c
@@ -28,7 +28,6 @@ struct timeval smb_last_time;
 static char *InBuffer = NULL;
 char *OutBuffer = NULL;
 char *last_inbuf = NULL;
-int global_smbpid;
 
 /* 
  * Size of data we can send to client. Set
@@ -419,6 +418,7 @@ static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize
   static int num_smb_messages = 
     sizeof(smb_messages) / sizeof(struct smb_message_struct);
   int match;
+  extern int global_smbpid;
 
   if (pid == (pid_t)-1)
     pid = getpid();