Remove cancel_aio_by_fsp(). It can never work and could lead to memory corruption

as outstanding IO's complete. Also we never have any aio's on a call to close_normal_file()
with close_type ERROR_CLOSE.

3 files changed, 18 insertions, 43 deletions

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index 8050e99498..5e2d2b3dfe 100644
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -911,12 +911,12 @@ void smbd_aio_complete_aio_ex(struct aio_extra *aio_ex)
 }
 
 /****************************************************************************
- We're doing write behind and the client closed the file. Wait up to 30
+ We're doing write behind and the client closed the file. Wait up to 45
  seconds (my arbitrary choice) for the aio to complete. Return 0 if all writes
  completed, errno to return if not.
 *****************************************************************************/
 
-#define SMB_TIME_FOR_AIO_COMPLETE_WAIT 29
+#define SMB_TIME_FOR_AIO_COMPLETE_WAIT 45
 
 int wait_for_aio_completion(files_struct *fsp)
 {
@@ -980,8 +980,14 @@ int wait_for_aio_completion(files_struct *fsp)
 				 "%d seconds\n", aio_completion_count,
 				 seconds_left));
 			/* Timeout. */
-			cancel_aio_by_fsp(fsp);
 			SAFE_FREE(aiocb_list);
+			/* We're hosed here - IO may complete
+			   and trample over memory if we free
+			   the aio_ex struct, but if we don't
+			   we leak IO requests. I think smb_panic()
+			   if the right thing to do here. JRA.
+			*/
+			smb_panic("AIO suspend timed out - cannot continue.");
 			return EIO;
 		}
 
@@ -1010,29 +1016,6 @@ int wait_for_aio_completion(files_struct *fsp)
 	return EIO;
 }
 
-/****************************************************************************
- Cancel any outstanding aio requests. The client doesn't care about the reply.
-*****************************************************************************/
-
-void cancel_aio_by_fsp(files_struct *fsp)
-{
-	struct aio_extra *aio_ex;
-
-	for( aio_ex = aio_list_head; aio_ex; aio_ex = aio_ex->next) {
-		if (aio_ex->fsp == fsp) {
-			/* Unlock now we're done. */
-			SMB_VFS_STRICT_UNLOCK(fsp->conn, fsp, &aio_ex->lock);
-
-			/* Don't delete the aio_extra record as we may have
-			   completed and don't yet know it. Just do the
-			   aio_cancel call and return. */
-			SMB_VFS_AIO_CANCEL(fsp, &aio_ex->acb);
-			aio_ex->fsp = NULL; /* fsp will be closed when we
-					     * return. */
-		}
-	}
-}
-
 #else
 
 bool initialize_async_io_handler(void)
@@ -1083,10 +1066,6 @@ NTSTATUS schedule_aio_smb2_write(connection_struct *conn,
 	return NT_STATUS_RETRY;
 }
 
-void cancel_aio_by_fsp(files_struct *fsp)
-{
-}
-
 int wait_for_aio_completion(files_struct *fsp)
 {
 	return 0;
diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index dc6df47ee6..c87b1a000b 100644
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -667,19 +667,16 @@ static NTSTATUS close_normal_file(struct smb_request *req, files_struct *fsp,
 	NTSTATUS status = NT_STATUS_OK;
 	NTSTATUS tmp;
 	connection_struct *conn = fsp->conn;
+	int ret;
 
-	if (close_type == ERROR_CLOSE) {
-		cancel_aio_by_fsp(fsp);
-	} else {
-		/*
-	 	 * If we're finishing async io on a close we can get a write
-		 * error here, we must remember this.
-		 */
-		int ret = wait_for_aio_completion(fsp);
-		if (ret) {
-			status = ntstatus_keeperror(
-				status, map_nt_error_from_unix(ret));
-		}
+	/*
+	 * If we're finishing async io on a close we can get a write
+	 * error here, we must remember this.
+	 */
+	ret = wait_for_aio_completion(fsp);
+	if (ret) {
+		status = ntstatus_keeperror(
+			status, map_nt_error_from_unix(ret));
 	}
 
 	/*
diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index f2040cdbac..a770c3a2a4 100644
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -89,7 +89,6 @@ NTSTATUS schedule_aio_smb2_write(connection_struct *conn,
 				bool write_through);
 bool cancel_smb2_aio(struct smb_request *smbreq);
 int wait_for_aio_completion(files_struct *fsp);
-void cancel_aio_by_fsp(files_struct *fsp);
 void smbd_aio_complete_aio_ex(struct aio_extra *aio_ex);
 
 /* The following definitions come from smbd/blocking.c  */