diff options
| author | Volker Lendecke <vl@samba.org> | 2013-09-01 18:54:59 +0200 |
|---|---|---|
| committer | Michael Adam <obnox@samba.org> | 2013-09-03 19:13:14 +0200 |
| commit | ade8477f98fcffcc6e3c5ea31618b49d0c1bba95 (patch) | |
| tree | 3e9a355e67430b530ccd162c6ef234637bcc4613 /source3/torture | |
| parent | 7d91ffc6fdc3b371564e14f09822a96264ea372a (diff) | |
| download | samba-ade8477f98fcffcc6e3c5ea31618b49d0c1bba95.tar.gz samba-ade8477f98fcffcc6e3c5ea31618b49d0c1bba95.tar.bz2 samba-ade8477f98fcffcc6e3c5ea31618b49d0c1bba95.zip | |
torture3: Trigger a nasty cleanup bug in smbd
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Sep 3 19:13:14 CEST 2013 on sn-devel-104
Diffstat (limited to 'source3/torture')
| -rw-r--r-- | source3/torture/proto.h | 1 | ||||
| -rw-r--r-- | source3/torture/test_cleanup.c | 70 | ||||
| -rw-r--r-- | source3/torture/torture.c | 1 |
3 files changed, 72 insertions, 0 deletions
diff --git a/source3/torture/proto.h b/source3/torture/proto.h index f6453fd526..d430aef5d8 100644 --- a/source3/torture/proto.h +++ b/source3/torture/proto.h @@ -104,6 +104,7 @@ bool run_local_sprintf_append(int dummy); bool run_cleanup1(int dummy); bool run_cleanup2(int dummy); bool run_cleanup3(int dummy); +bool run_cleanup4(int dummy); bool run_ctdb_conn(int dummy); bool run_msg_test(int dummy); bool run_notify_bench2(int dummy); diff --git a/source3/torture/test_cleanup.c b/source3/torture/test_cleanup.c index d9dce402de..319a55f329 100644 --- a/source3/torture/test_cleanup.c +++ b/source3/torture/test_cleanup.c @@ -329,3 +329,73 @@ bool run_cleanup3(int dummy) return true; } + +bool run_cleanup4(int dummy) +{ + struct cli_state *cli1, *cli2; + const char *fname = "\\cleanup4"; + uint16_t fnum1, fnum2; + NTSTATUS status; + + printf("CLEANUP4: Checking that a conflicting share mode is cleaned " + "up\n"); + + if (!torture_open_connection(&cli1, 0)) { + return false; + } + if (!torture_open_connection(&cli2, 0)) { + return false; + } + + status = cli_ntcreate( + cli1, fname, 0, + FILE_GENERIC_READ|DELETE_ACCESS, + FILE_ATTRIBUTE_NORMAL, + FILE_SHARE_READ|FILE_SHARE_DELETE, + FILE_OVERWRITE_IF, 0, 0, &fnum1); + if (!NT_STATUS_IS_OK(status)) { + printf("creating file failed: %s\n", + nt_errstr(status)); + return false; + } + + status = cli_ntcreate( + cli2, fname, 0, + FILE_GENERIC_READ|DELETE_ACCESS, + FILE_ATTRIBUTE_NORMAL, + FILE_SHARE_READ|FILE_SHARE_DELETE, + FILE_OPEN, 0, 0, &fnum2); + if (!NT_STATUS_IS_OK(status)) { + printf("opening file 1st time failed: %s\n", + nt_errstr(status)); + return false; + } + + status = smbXcli_conn_samba_suicide(cli1->conn, 1); + if (!NT_STATUS_IS_OK(status)) { + printf("smbXcli_conn_samba_suicide failed: %s\n", + nt_errstr(status)); + return false; + } + + /* + * The next open will conflict with both opens above. The first open + * above will be correctly cleaned up. A bug in smbd iterating over + * the share mode array made it skip the share conflict check for the + * second open. Trigger this bug. + */ + + status = cli_ntcreate( + cli2, fname, 0, + FILE_GENERIC_WRITE|DELETE_ACCESS, + FILE_ATTRIBUTE_NORMAL, + FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, + FILE_OPEN, 0, 0, &fnum2); + if (!NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) { + printf("opening file 2nd time returned: %s\n", + nt_errstr(status)); + return false; + } + + return true; +} diff --git a/source3/torture/torture.c b/source3/torture/torture.c index 359baa9cb4..2d1a107b34 100644 --- a/source3/torture/torture.c +++ b/source3/torture/torture.c @@ -9554,6 +9554,7 @@ static struct { { "CLEANUP1", run_cleanup1 }, { "CLEANUP2", run_cleanup2 }, { "CLEANUP3", run_cleanup3 }, + { "CLEANUP4", run_cleanup4 }, { "LOCAL-SUBSTITUTE", run_local_substitute, 0}, { "LOCAL-GENCACHE", run_local_gencache, 0}, { "LOCAL-TALLOC-DICT", run_local_talloc_dict, 0}, |