Fix a valgrind error found by SMB2-COMPOUND test.

If a file is closed we must also NULL out all chained_fsp
pointers when the fsp is freed to prevent invalid pointer
access.

Jeremy.

1 files changed, 20 insertions, 0 deletions

diff --git a/source3/smbd/smb2_glue.c b/source3/smbd/smb2_glue.c
index d6252ef349..8b595affe0 100644
--- a/source3/smbd/smb2_glue.c
+++ b/source3/smbd/smb2_glue.c
@@ -49,6 +49,26 @@ struct smb_request *smbd_smb2_fake_smb_request(struct smbd_smb2_request *req)
 	smbreq->mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 	smbreq->chain_fsp = req->compat_chain_fsp;
 	smbreq->smb2req = req;
+	req->smb1req = smbreq;
 
 	return smbreq;
 }
+
+/*********************************************************
+ Called from file_free() to remove any chained fsp pointers.
+*********************************************************/
+
+void remove_smb2_chained_fsp(files_struct *fsp)
+{
+	struct smbd_server_connection *sconn = smbd_server_conn;
+	struct smbd_smb2_request *smb2req;
+
+	for (smb2req = sconn->smb2.requests; smb2req; smb2req = smb2req->next) {
+		if (smb2req->compat_chain_fsp == fsp) {
+			smb2req->compat_chain_fsp = NULL;
+		}
+		if (smb2req->smb1req && smb2req->smb1req->chain_fsp == fsp) {
+			smb2req->smb1req->chain_fsp = NULL;
+		}
+	}
+}