From 40532ec133a6c4ffb9fbbf17f68253c62cf93798 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Tue, 20 Feb 2024 09:26:29 +0000 Subject: [PATCH] s3/smbd: If we fail to close file_handle ensure we should reset the fd if fsp_flags.fstat_before_close == true then close_file_smb will call vfs_stat which can fail. If it does fail then the fd associated with the file handle will still be set (and we will hit an assert is the file handle destructor) when calling file_free. We need to set fd to -1 to avoid that. [2024/02/20 09:23:48.454671, 0, pid=9744] ../../source3/smbd/smb2_close.c:226(smbd_smb2_close) smbd_smb2_close: close_file[]: NT_STATUS_ACCESS_DENIED [2024/02/20 09:23:48.454757, 0, pid=9744] ../../source3/smbd/fd_handle.c:40(fd_handle_destructor) PANIC: assert failed at ../../source3/smbd/fd_handle.c(40): (fh->fd == -1) || (fh->fd == AT_FDCWD) [2024/02/20 09:23:48.454781, 0, pid=9744] ../../lib/util/fault.c:178(smb_panic_log) =============================================================== [2024/02/20 09:23:48.454804, 0, pid=9744] ../../lib/util/fault.c:185(smb_panic_log) INTERNAL ERROR: assert failed: (fh->fd == -1) || (fh->fd == AT_FDCWD) in smbd (smbd[192.168.10) (client [192.168.100.15]) pid 9744 (4.21.0pre1-DEVELOPERBUILD) [2024/02/20 09:23:48.454844, 0, pid=9744] ../../lib/util/fault.c:190(smb_panic_log) If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting [2024/02/20 09:23:48.454869, 0, pid=9744] ../../lib/util/fault.c:191(smb_panic_log) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15587 Signed-off-by: Noel Power --- source3/smbd/smb2_close.c | 1 + 1 file changed, 1 insertion(+) diff --git a/source3/smbd/smb2_close.c b/source3/smbd/smb2_close.c index 996ca8b283c..43e6ee54752 100644 --- a/source3/smbd/smb2_close.c +++ b/source3/smbd/smb2_close.c @@ -225,6 +225,7 @@ static NTSTATUS smbd_smb2_close(struct smbd_smb2_request *req, if (!NT_STATUS_IS_OK(status)) { DEBUG(5,("smbd_smb2_close: close_file[%s]: %s\n", smb_fname_str_dbg(smb_fname), nt_errstr(status))); + fsp_set_fd(fsp, -1); file_free(smbreq, fsp); *_fsp = fsp = NULL; return status; -- 2.35.3