Don't allow asynchronous creates to be canceled in SMB2.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jun 30 04:10:02 CEST 2012 on sn-devel-104

3 files changed, 20 insertions, 3 deletions

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 467a69f049..c2bf8edb7a 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -1685,6 +1685,17 @@ void remove_deferred_open_entry(struct file_id id, uint64_t mid,
 }
 
 /****************************************************************************
+ Return true if this is a state pointer to an asynchronous create.
+****************************************************************************/
+
+bool is_deferred_open_async(const void *ptr)
+{
+	const struct deferred_open_record *state = (const struct deferred_open_record *)ptr;
+
+	return state->async_open;
+}
+
+/****************************************************************************
  Open a file with a share mode. Passed in an already created files_struct *.
 ****************************************************************************/
 
@@ -1788,18 +1799,18 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
 		if (get_deferred_open_message_state(req,
 				&request_time,
 				&ptr)) {
-
-			struct deferred_open_record *state = (struct deferred_open_record *)ptr;
 			/* Remember the absolute time of the original
 			   request with this mid. We'll use it later to
 			   see if this has timed out. */
 
 			/* If it was an async create retry, the file
 			   didn't exist. */
-			if (state->async_open) {
+
+			if (is_deferred_open_async(ptr)) {
 				SET_STAT_INVALID(smb_fname->st);
 				file_existed = false;
 			} else {
+				struct deferred_open_record *state = (struct deferred_open_record *)ptr;
 				/* Remove the deferred open entry under lock. */
 				remove_deferred_open_entry(
 					state->id, req->mid,
diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index f566b3258d..1b28c8b86b 100644
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -616,6 +616,7 @@ bool open_match_attributes(connection_struct *conn,
 			   mode_t *returned_unx_mode);
 void remove_deferred_open_entry(struct file_id id, uint64_t mid,
 				struct server_id pid);
+bool is_deferred_open_async(const void *ptr);
 NTSTATUS open_file_fchmod(connection_struct *conn,
 			  struct smb_filename *smb_fname,
 			  files_struct **result);
diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c
index b69f268c9e..7b5a26269b 100644
--- a/source3/smbd/smb2_create.c
+++ b/source3/smbd/smb2_create.c
@@ -1162,6 +1162,11 @@ static bool smbd_smb2_create_cancel(struct tevent_req *req)
 	smb2req = state->smb2req;
 	mid = get_mid_from_smb2req(smb2req);
 
+	if (is_deferred_open_async(state->private_data.data)) {
+		/* Can't cancel an async create. */
+		return false;
+	}
+
 	remove_deferred_open_entry(state->id, mid,
 				   messaging_server_id(smb2req->sconn->msg_ctx));
 	remove_deferred_open_message_smb2_internal(smb2req, mid);