Make conn_close_all() safe to call from SMB2 sessions (fix crash bug).

Ensure we don't call close_cnum() with SMB2, also talloc_move the
compat_conn pointer from the NULL context onto the tcon context
in SMB2 as it's conceptually owned by that pointer.

Jeremy.

1 files changed, 19 insertions, 8 deletions

diff --git a/source3/smbd/conn.c b/source3/smbd/conn.c
index 959fcd7754..51f880d9df 100644
--- a/source3/smbd/conn.c
+++ b/source3/smbd/conn.c
@@ -177,15 +177,26 @@ return true if any were closed
 ****************************************************************************/
 bool conn_close_all(struct smbd_server_connection *sconn)
 {
-	connection_struct *conn, *next;
-	bool ret = false;
-	for (conn=sconn->smb1.tcons.Connections;conn;conn=next) {
-		next=conn->next;
-		set_current_service(conn, 0, True);
-		close_cnum(conn, conn->vuid);
-		ret = true;
+	if (sconn->allow_smb2) {
+		/* SMB2 */
+		if (sconn->smb2.sessions.list &&
+				sconn->smb2.sessions.list->tcons.list) {
+			return true;
+		}
+		return false;
+	} else {
+		/* SMB1 */
+		connection_struct *conn, *next;
+		bool ret = false;
+
+		for (conn=sconn->smb1.tcons.Connections;conn;conn=next) {
+			next=conn->next;
+			set_current_service(conn, 0, True);
+			close_cnum(conn, conn->vuid);
+			ret = true;
+		}
+		return ret;
 	}
-	return ret;
 }
 
 /****************************************************************************