source3/smbd/blocking.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Blocking Locking functions
   4    Copyright (C) Jeremy Allison 1998-2003
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "smbd/globals.h"
  22
  23 #undef DBGC_CLASS
  24 #define DBGC_CLASS DBGC_LOCKING
  25
  26 /****************************************************************************
  27  Determine if this is a secondary element of a chained SMB.
  28   **************************************************************************/
  29
  30 static void received_unlock_msg(struct messaging_context *msg,
  31                                 void *private_data,
  32                                 uint32_t msg_type,
  33                                 struct server_id server_id,
  34                                 DATA_BLOB *data);
  35
  36 static void brl_timeout_fn(struct event_context *event_ctx,
  37                            struct timed_event *te,
  38                            struct timeval now,
  39                            void *private_data)
  40 {
  41         SMB_ASSERT(brl_timeout == te);
  42         TALLOC_FREE(brl_timeout);
  43
  44         change_to_root_user();  /* TODO: Possibly run all timed events as
  45                                  * root */
  46
  47         process_blocking_lock_queue();
  48 }
  49
  50 /****************************************************************************
  51  We need a version of timeval_min that treats zero timval as infinite.
  52 ****************************************************************************/
  53
  54 static struct timeval timeval_brl_min(const struct timeval *tv1,
  55                                         const struct timeval *tv2)
  56 {
  57         if (timeval_is_zero(tv1)) {
  58                 return *tv2;
  59         }
  60         if (timeval_is_zero(tv2)) {
  61                 return *tv1;
  62         }
  63         return timeval_min(tv1, tv2);
  64 }
  65
  66 /****************************************************************************
  67  After a change to blocking_lock_queue, recalculate the timed_event for the
  68  next processing.
  69 ****************************************************************************/
  70
  71 static bool recalc_brl_timeout(void)
  72 {
  73         struct blocking_lock_record *blr;
  74         struct timeval next_timeout;
  75
  76         TALLOC_FREE(brl_timeout);
  77
  78         next_timeout = timeval_zero();
  79
  80         for (blr = blocking_lock_queue; blr; blr = blr->next) {
  81                 if (timeval_is_zero(&blr->expire_time)) {
  82                         /*
  83                          * If we're blocked on pid 0xFFFFFFFF this is
  84                          * a POSIX lock, so calculate a timeout of
  85                          * 10 seconds into the future.
  86                          */
  87                         if (blr->blocking_pid == 0xFFFFFFFF) {
  88                                 struct timeval psx_to = timeval_current_ofs(10, 0);
  89                                 next_timeout = timeval_brl_min(&next_timeout, &psx_to);
  90                         }
  91
  92                         continue;
  93                 }
  94
  95                 next_timeout = timeval_brl_min(&next_timeout, &blr->expire_time);
  96         }
  97
  98         if (timeval_is_zero(&next_timeout)) {
  99                 DEBUG(10, ("Next timeout = Infinite.\n"));
 100                 return True;
 101         }
 102
 103         if (DEBUGLVL(10)) {
 104                 struct timeval cur, from_now;
 105
 106                 cur = timeval_current();
 107                 from_now = timeval_until(&cur, &next_timeout);
 108                 DEBUG(10, ("Next timeout = %d.%d seconds from now.\n",
 109                     (int)from_now.tv_sec, (int)from_now.tv_usec));
 110         }
 111
 112         if (!(brl_timeout = event_add_timed(smbd_event_context(), NULL,
 113                                             next_timeout,
 114                                             brl_timeout_fn, NULL))) {
 115                 return False;
 116         }
 117
 118         return True;
 119 }
 120
 121
 122 /****************************************************************************
 123  Function to push a blocking lock request onto the lock queue.
 124 ****************************************************************************/
 125
 126 bool push_blocking_lock_request( struct byte_range_lock *br_lck,
 127                 struct smb_request *req,
 128                 files_struct *fsp,
 129                 int lock_timeout,
 130                 int lock_num,
 131                 uint32_t lock_pid,
 132                 enum brl_type lock_type,
 133                 enum brl_flavour lock_flav,
 134                 uint64_t offset,
 135                 uint64_t count,
 136                 uint32_t blocking_pid)
 137 {
 138         struct blocking_lock_record *blr;
 139         NTSTATUS status;
 140
 141         if(req_is_in_chain(req)) {
 142                 DEBUG(0,("push_blocking_lock_request: cannot queue a chained request (currently).\n"));
 143                 return False;
 144         }
 145
 146         /*
 147          * Now queue an entry on the blocking lock queue. We setup
 148          * the expiration time here.
 149          */
 150
 151         blr = talloc(NULL, struct blocking_lock_record);
 152         if (blr == NULL) {
 153                 DEBUG(0,("push_blocking_lock_request: Malloc fail !\n" ));
 154                 return False;
 155         }
 156
 157         blr->next = NULL;
 158         blr->prev = NULL;
 159
 160         blr->fsp = fsp;
 161         if (lock_timeout == -1) {
 162                 blr->expire_time.tv_sec = 0;
 163                 blr->expire_time.tv_usec = 0; /* Never expire. */
 164         } else {
 165                 blr->expire_time = timeval_current_ofs(lock_timeout/1000,
 166                                         (lock_timeout % 1000) * 1000);
 167         }
 168         blr->lock_num = lock_num;
 169         blr->lock_pid = lock_pid;
 170         blr->blocking_pid = blocking_pid;
 171         blr->lock_flav = lock_flav;
 172         blr->lock_type = lock_type;
 173         blr->offset = offset;
 174         blr->count = count;
 175
 176         /* Specific brl_lock() implementations can fill this in. */
 177         blr->blr_private = NULL;
 178
 179         /* Add a pending lock record for this. */
 180         status = brl_lock(smbd_messaging_context(),
 181                         br_lck,
 182                         lock_pid,
 183                         procid_self(),
 184                         offset,
 185                         count,
 186                         lock_type == READ_LOCK ? PENDING_READ_LOCK : PENDING_WRITE_LOCK,
 187                         blr->lock_flav,
 188                         lock_timeout ? True : False, /* blocking_lock. */
 189                         NULL,
 190                         blr);
 191
 192         if (!NT_STATUS_IS_OK(status)) {
 193                 DEBUG(0,("push_blocking_lock_request: failed to add PENDING_LOCK record.\n"));
 194                 TALLOC_FREE(blr);
 195                 return False;
 196         }
 197
 198         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &req->pcd);
 199         blr->req = talloc_move(blr, &req);
 200
 201         DLIST_ADD_END(blocking_lock_queue, blr, struct blocking_lock_record *);
 202         recalc_brl_timeout();
 203
 204         /* Ensure we'll receive messages when this is unlocked. */
 205         if (!blocking_lock_unlock_state) {
 206                 messaging_register(smbd_messaging_context(), NULL,
 207                                    MSG_SMB_UNLOCK, received_unlock_msg);
 208                 blocking_lock_unlock_state = true;
 209         }
 210
 211         DEBUG(3,("push_blocking_lock_request: lock request blocked with "
 212                 "expiry time (%u sec. %u usec) (+%d msec) for fnum = %d, name = %s\n",
 213                 (unsigned int)blr->expire_time.tv_sec,
 214                 (unsigned int)blr->expire_time.tv_usec, lock_timeout,
 215                 blr->fsp->fnum, blr->fsp->fsp_name ));
 216
 217         /* Push the MID of this packet on the signing queue. */
 218         srv_defer_sign_response(blr->req->mid);
 219
 220         return True;
 221 }
 222
 223 /****************************************************************************
 224  Return a lockingX success SMB.
 225 *****************************************************************************/
 226
 227 static void reply_lockingX_success(struct blocking_lock_record *blr)
 228 {
 229         reply_outbuf(blr->req, 2, 0);
 230
 231         /*
 232          * As this message is a lockingX call we must handle
 233          * any following chained message correctly.
 234          * This is normally handled in construct_reply(),
 235          * but as that calls switch_message, we can't use
 236          * that here and must set up the chain info manually.
 237          */
 238
 239         chain_reply(blr->req);
 240         TALLOC_FREE(blr->req->outbuf);
 241 }
 242
 243 /****************************************************************************
 244  Return a generic lock fail error blocking call.
 245 *****************************************************************************/
 246
 247 static void generic_blocking_lock_error(struct blocking_lock_record *blr, NTSTATUS status)
 248 {
 249         /* whenever a timeout is given w2k maps LOCK_NOT_GRANTED to
 250            FILE_LOCK_CONFLICT! (tridge) */
 251         if (NT_STATUS_EQUAL(status, NT_STATUS_LOCK_NOT_GRANTED)) {
 252                 status = NT_STATUS_FILE_LOCK_CONFLICT;
 253         }
 254
 255         if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_LOCK_CONFLICT)) {
 256                 /* Store the last lock error. */
 257                 files_struct *fsp = blr->fsp;
 258
 259                 if (fsp) {
 260                         fsp->last_lock_failure.context.smbpid = blr->lock_pid;
 261                         fsp->last_lock_failure.context.tid = fsp->conn->cnum;
 262                         fsp->last_lock_failure.context.pid = procid_self();
 263                         fsp->last_lock_failure.start = blr->offset;
 264                         fsp->last_lock_failure.size = blr->count;
 265                         fsp->last_lock_failure.fnum = fsp->fnum;
 266                         fsp->last_lock_failure.lock_type = READ_LOCK; /* Don't care. */
 267                         fsp->last_lock_failure.lock_flav = blr->lock_flav;
 268                 }
 269         }
 270
 271         reply_nterror(blr->req, status);
 272         if (!srv_send_smb(smbd_server_fd(), (char *)blr->req->outbuf,
 273                           blr->req->encrypted, NULL)) {
 274                 exit_server_cleanly("generic_blocking_lock_error: srv_send_smb failed.");
 275         }
 276         TALLOC_FREE(blr->req->outbuf);
 277 }
 278
 279 /****************************************************************************
 280  Return a lock fail error for a lockingX call. Undo all the locks we have
 281  obtained first.
 282 *****************************************************************************/
 283
 284 static void reply_lockingX_error(struct blocking_lock_record *blr, NTSTATUS status)
 285 {
 286         files_struct *fsp = blr->fsp;
 287         uint16 num_ulocks = SVAL(blr->req->vwv+6, 0);
 288         uint64_t count = (uint64_t)0, offset = (uint64_t) 0;
 289         uint32 lock_pid;
 290         unsigned char locktype = CVAL(blr->req->vwv+3, 0);
 291         bool large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES);
 292         uint8_t *data;
 293         int i;
 294
 295         data = (uint8_t *)blr->req->buf
 296                 + ((large_file_format ? 20 : 10)*num_ulocks);
 297
 298         /*
 299          * Data now points at the beginning of the list
 300          * of smb_lkrng structs.
 301          */
 302
 303         /*
 304          * Ensure we don't do a remove on the lock that just failed,
 305          * as under POSIX rules, if we have a lock already there, we
 306          * will delete it (and we shouldn't) .....
 307          */
 308
 309         for(i = blr->lock_num - 1; i >= 0; i--) {
 310                 bool err;
 311
 312                 lock_pid = get_lock_pid( data, i, large_file_format);
 313                 count = get_lock_count( data, i, large_file_format);
 314                 offset = get_lock_offset( data, i, large_file_format, &err);
 315
 316                 /*
 317                  * We know err cannot be set as if it was the lock
 318                  * request would never have been queued. JRA.
 319                  */
 320
 321                 do_unlock(smbd_messaging_context(),
 322                         fsp,
 323                         lock_pid,
 324                         count,
 325                         offset,
 326                         WINDOWS_LOCK);
 327         }
 328
 329         generic_blocking_lock_error(blr, status);
 330 }
 331
 332 /****************************************************************************
 333  Return a lock fail error.
 334 *****************************************************************************/
 335
 336 static void blocking_lock_reply_error(struct blocking_lock_record *blr, NTSTATUS status)
 337 {
 338         DEBUG(10, ("Replying with error=%s. BLR = %p\n", nt_errstr(status), blr));
 339
 340         switch(blr->req->cmd) {
 341         case SMBlockingX:
 342                 reply_lockingX_error(blr, status);
 343                 break;
 344         case SMBtrans2:
 345         case SMBtranss2:
 346                 reply_nterror(blr->req, status);
 347
 348                 /*
 349                  * construct_reply_common has done us the favor to pre-fill
 350                  * the command field with SMBtranss2 which is wrong :-)
 351                  */
 352                 SCVAL(blr->req->outbuf,smb_com,SMBtrans2);
 353
 354                 if (!srv_send_smb(smbd_server_fd(),
 355                                   (char *)blr->req->outbuf,
 356                                   IS_CONN_ENCRYPTED(blr->fsp->conn),
 357                                   NULL)) {
 358                         exit_server_cleanly("blocking_lock_reply_error: "
 359                                             "srv_send_smb failed.");
 360                 }
 361                 TALLOC_FREE(blr->req->outbuf);
 362                 break;
 363         default:
 364                 DEBUG(0,("blocking_lock_reply_error: PANIC - unknown type on blocking lock queue - exiting.!\n"));
 365                 exit_server("PANIC - unknown type on blocking lock queue");
 366         }
 367 }
 368
 369 /****************************************************************************
 370  Attempt to finish off getting all pending blocking locks for a lockingX call.
 371  Returns True if we want to be removed from the list.
 372 *****************************************************************************/
 373
 374 static bool process_lockingX(struct blocking_lock_record *blr)
 375 {
 376         unsigned char locktype = CVAL(blr->req->vwv+3, 0);
 377         files_struct *fsp = blr->fsp;
 378         uint16 num_ulocks = SVAL(blr->req->vwv+6, 0);
 379         uint16 num_locks = SVAL(blr->req->vwv+7, 0);
 380         uint64_t count = (uint64_t)0, offset = (uint64_t)0;
 381         uint32 lock_pid;
 382         bool large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES);
 383         uint8_t *data;
 384         NTSTATUS status = NT_STATUS_OK;
 385
 386         data = (uint8_t *)blr->req->buf
 387                 + ((large_file_format ? 20 : 10)*num_ulocks);
 388
 389         /*
 390          * Data now points at the beginning of the list
 391          * of smb_lkrng structs.
 392          */
 393
 394         for(; blr->lock_num < num_locks; blr->lock_num++) {
 395                 struct byte_range_lock *br_lck = NULL;
 396                 bool err;
 397
 398                 lock_pid = get_lock_pid( data, blr->lock_num, large_file_format);
 399                 count = get_lock_count( data, blr->lock_num, large_file_format);
 400                 offset = get_lock_offset( data, blr->lock_num, large_file_format, &err);
 401
 402                 /*
 403                  * We know err cannot be set as if it was the lock
 404                  * request would never have been queued. JRA.
 405                  */
 406                 errno = 0;
 407                 br_lck = do_lock(smbd_messaging_context(),
 408                                 fsp,
 409                                 lock_pid,
 410                                 count,
 411                                 offset,
 412                                 ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
 413                                         READ_LOCK : WRITE_LOCK),
 414                                 WINDOWS_LOCK,
 415                                 True,
 416                                 &status,
 417                                 &blr->blocking_pid,
 418                                 blr);
 419
 420                 TALLOC_FREE(br_lck);
 421
 422                 if (NT_STATUS_IS_ERR(status)) {
 423                         break;
 424                 }
 425         }
 426
 427         if(blr->lock_num == num_locks) {
 428                 /*
 429                  * Success - we got all the locks.
 430                  */
 431
 432                 DEBUG(3,("process_lockingX file = %s, fnum=%d type=%d num_locks=%d\n",
 433                          fsp->fsp_name, fsp->fnum, (unsigned int)locktype, num_locks) );
 434
 435                 reply_lockingX_success(blr);
 436                 return True;
 437         }
 438
 439         if (!NT_STATUS_EQUAL(status,NT_STATUS_LOCK_NOT_GRANTED) &&
 440             !NT_STATUS_EQUAL(status,NT_STATUS_FILE_LOCK_CONFLICT)) {
 441                 /*
 442                  * We have other than a "can't get lock"
 443                  * error. Free any locks we had and return an error.
 444                  * Return True so we get dequeued.
 445                  */
 446                 blocking_lock_reply_error(blr, status);
 447                 return True;
 448         }
 449
 450         /*
 451          * Still can't get all the locks - keep waiting.
 452          */
 453
 454         DEBUG(10,("process_lockingX: only got %d locks of %d needed for file %s, fnum = %d. \
 455 Waiting....\n",
 456                   blr->lock_num, num_locks, fsp->fsp_name, fsp->fnum));
 457
 458         return False;
 459 }
 460
 461 /****************************************************************************
 462  Attempt to get the posix lock request from a SMBtrans2 call.
 463  Returns True if we want to be removed from the list.
 464 *****************************************************************************/
 465
 466 static bool process_trans2(struct blocking_lock_record *blr)
 467 {
 468         char params[2];
 469         NTSTATUS status;
 470         struct byte_range_lock *br_lck = do_lock(smbd_messaging_context(),
 471                                                 blr->fsp,
 472                                                 blr->lock_pid,
 473                                                 blr->count,
 474                                                 blr->offset,
 475                                                 blr->lock_type,
 476                                                 blr->lock_flav,
 477                                                 True,
 478                                                 &status,
 479                                                 &blr->blocking_pid,
 480                                                 blr);
 481         TALLOC_FREE(br_lck);
 482
 483         if (!NT_STATUS_IS_OK(status)) {
 484                 if (ERROR_WAS_LOCK_DENIED(status)) {
 485                         /* Still can't get the lock, just keep waiting. */
 486                         return False;
 487                 }
 488                 /*
 489                  * We have other than a "can't get lock"
 490                  * error. Send an error and return True so we get dequeued.
 491                  */
 492                 blocking_lock_reply_error(blr, status);
 493                 return True;
 494         }
 495
 496         /* We finally got the lock, return success. */
 497
 498         SSVAL(params,0,0);
 499         /* Fake up max_data_bytes here - we know it fits. */
 500         send_trans2_replies(blr->fsp->conn, blr->req, params, 2, NULL, 0, 0xffff);
 501         return True;
 502 }
 503
 504
 505 /****************************************************************************
 506  Process a blocking lock SMB.
 507  Returns True if we want to be removed from the list.
 508 *****************************************************************************/
 509
 510 static bool blocking_lock_record_process(struct blocking_lock_record *blr)
 511 {
 512         switch(blr->req->cmd) {
 513                 case SMBlockingX:
 514                         return process_lockingX(blr);
 515                 case SMBtrans2:
 516                 case SMBtranss2:
 517                         return process_trans2(blr);
 518                 default:
 519                         DEBUG(0,("blocking_lock_record_process: PANIC - unknown type on blocking lock queue - exiting.!\n"));
 520                         exit_server("PANIC - unknown type on blocking lock queue");
 521         }
 522         return False; /* Keep compiler happy. */
 523 }
 524
 525 /****************************************************************************
 526  Cancel entries by fnum from the blocking lock pending queue.
 527 *****************************************************************************/
 528
 529 void cancel_pending_lock_requests_by_fid(files_struct *fsp, struct byte_range_lock *br_lck)
 530 {
 531         struct blocking_lock_record *blr, *blr_cancelled, *next = NULL;
 532
 533         for(blr = blocking_lock_queue; blr; blr = next) {
 534                 unsigned char locktype = 0;
 535
 536                 next = blr->next;
 537                 if (blr->fsp->fnum != fsp->fnum) {
 538                         continue;
 539                 }
 540
 541                 if (blr->req->cmd == SMBlockingX) {
 542                         locktype = CVAL(blr->req->vwv+3, 0);
 543                 }
 544
 545                 DEBUG(10, ("remove_pending_lock_requests_by_fid - removing "
 546                            "request type %d for file %s fnum = %d\n",
 547                            blr->req->cmd, fsp->fsp_name, fsp->fnum));
 548
 549                 blr_cancelled = blocking_lock_cancel(fsp,
 550                                      blr->lock_pid,
 551                                      blr->offset,
 552                                      blr->count,
 553                                      blr->lock_flav,
 554                                      locktype,
 555                                      NT_STATUS_RANGE_NOT_LOCKED);
 556
 557                 SMB_ASSERT(blr_cancelled == blr);
 558
 559                 brl_lock_cancel(br_lck,
 560                                 blr->lock_pid,
 561                                 procid_self(),
 562                                 blr->offset,
 563                                 blr->count,
 564                                 blr->lock_flav,
 565                                 blr);
 566
 567                 /* We're closing the file fsp here, so ensure
 568                  * we don't have a dangling pointer. */
 569                 blr->fsp = NULL;
 570         }
 571 }
 572
 573 /****************************************************************************
 574  Delete entries by mid from the blocking lock pending queue. Always send reply.
 575 *****************************************************************************/
 576
 577 void remove_pending_lock_requests_by_mid(int mid)
 578 {
 579         struct blocking_lock_record *blr, *next = NULL;
 580
 581         for(blr = blocking_lock_queue; blr; blr = next) {
 582                 files_struct *fsp;
 583                 struct byte_range_lock *br_lck;
 584
 585                 next = blr->next;
 586
 587                 if (blr->req->mid != mid) {
 588                         continue;
 589                 }
 590
 591                 fsp = blr->fsp;
 592                 br_lck = brl_get_locks(talloc_tos(), fsp);
 593
 594                 if (br_lck) {
 595                         DEBUG(10, ("remove_pending_lock_requests_by_mid - "
 596                                    "removing request type %d for file %s fnum "
 597                                    "= %d\n", blr->req->cmd, fsp->fsp_name,
 598                                    fsp->fnum ));
 599
 600                         brl_lock_cancel(br_lck,
 601                                         blr->lock_pid,
 602                                         procid_self(),
 603                                         blr->offset,
 604                                         blr->count,
 605                                         blr->lock_flav,
 606                                         blr);
 607                         TALLOC_FREE(br_lck);
 608                 }
 609
 610                 blocking_lock_reply_error(blr,NT_STATUS_FILE_LOCK_CONFLICT);
 611                 DLIST_REMOVE(blocking_lock_queue, blr);
 612                 TALLOC_FREE(blr);
 613         }
 614 }
 615
 616 /****************************************************************************
 617  Is this mid a blocking lock request on the queue ?
 618 *****************************************************************************/
 619
 620 bool blocking_lock_was_deferred(int mid)
 621 {
 622         struct blocking_lock_record *blr, *next = NULL;
 623
 624         for(blr = blocking_lock_queue; blr; blr = next) {
 625                 next = blr->next;
 626                 if(blr->req->mid == mid) {
 627                         return True;
 628                 }
 629         }
 630         return False;
 631 }
 632
 633 /****************************************************************************
 634   Set a flag as an unlock request affects one of our pending locks.
 635 *****************************************************************************/
 636
 637 static void received_unlock_msg(struct messaging_context *msg,
 638                                 void *private_data,
 639                                 uint32_t msg_type,
 640                                 struct server_id server_id,
 641                                 DATA_BLOB *data)
 642 {
 643         DEBUG(10,("received_unlock_msg\n"));
 644         process_blocking_lock_queue();
 645 }
 646
 647 /****************************************************************************
 648  Process the blocking lock queue. Note that this is only called as root.
 649 *****************************************************************************/
 650
 651 void process_blocking_lock_queue(void)
 652 {
 653         struct timeval tv_curr = timeval_current();
 654         struct blocking_lock_record *blr, *next = NULL;
 655         bool recalc_timeout = False;
 656
 657         /*
 658          * Go through the queue and see if we can get any of the locks.
 659          */
 660
 661         for (blr = blocking_lock_queue; blr; blr = next) {
 662
 663                 next = blr->next;
 664
 665                 /*
 666                  * Go through the remaining locks and try and obtain them.
 667                  * The call returns True if all locks were obtained successfully
 668                  * and False if we still need to wait.
 669                  */
 670
 671                 DEBUG(10, ("Processing BLR = %p\n", blr));
 672
 673                 if(blocking_lock_record_process(blr)) {
 674                         struct byte_range_lock *br_lck = brl_get_locks(
 675                                 talloc_tos(), blr->fsp);
 676
 677                         DEBUG(10, ("BLR_process returned true: cancelling and "
 678                             "removing lock. BLR = %p\n", blr));
 679
 680                         if (br_lck) {
 681                                 brl_lock_cancel(br_lck,
 682                                         blr->lock_pid,
 683                                         procid_self(),
 684                                         blr->offset,
 685                                         blr->count,
 686                                         blr->lock_flav,
 687                                         blr);
 688                                 TALLOC_FREE(br_lck);
 689                         }
 690
 691                         DLIST_REMOVE(blocking_lock_queue, blr);
 692                         TALLOC_FREE(blr);
 693                         recalc_timeout = True;
 694                         continue;
 695                 }
 696
 697                 /*
 698                  * We couldn't get the locks for this record on the list.
 699                  * If the time has expired, return a lock error.
 700                  */
 701
 702                 if (!timeval_is_zero(&blr->expire_time) && timeval_compare(&blr->expire_time, &tv_curr) <= 0) {
 703                         struct byte_range_lock *br_lck = brl_get_locks(
 704                                 talloc_tos(), blr->fsp);
 705
 706                         DEBUG(10, ("Lock timed out! BLR = %p\n", blr));
 707
 708                         /*
 709                          * Lock expired - throw away all previously
 710                          * obtained locks and return lock error.
 711                          */
 712
 713                         if (br_lck) {
 714                                 DEBUG(5,("process_blocking_lock_queue: "
 715                                          "pending lock fnum = %d for file %s "
 716                                          "timed out.\n", blr->fsp->fnum,
 717                                          blr->fsp->fsp_name ));
 718
 719                                 brl_lock_cancel(br_lck,
 720                                         blr->lock_pid,
 721                                         procid_self(),
 722                                         blr->offset,
 723                                         blr->count,
 724                                         blr->lock_flav,
 725                                         blr);
 726                                 TALLOC_FREE(br_lck);
 727                         }
 728
 729                         blocking_lock_reply_error(blr,NT_STATUS_FILE_LOCK_CONFLICT);
 730                         DLIST_REMOVE(blocking_lock_queue, blr);
 731                         TALLOC_FREE(blr);
 732                         recalc_timeout = True;
 733                 }
 734         }
 735
 736         if (recalc_timeout) {
 737                 recalc_brl_timeout();
 738         }
 739 }
 740
 741 /****************************************************************************
 742  Handle a cancel message. Lock already moved onto the cancel queue.
 743 *****************************************************************************/
 744
 745 #define MSG_BLOCKING_LOCK_CANCEL_SIZE (sizeof(struct blocking_lock_record *) + sizeof(NTSTATUS))
 746
 747 static void process_blocking_lock_cancel_message(struct messaging_context *ctx,
 748                                                  void *private_data,
 749                                                  uint32_t msg_type,
 750                                                  struct server_id server_id,
 751                                                  DATA_BLOB *data)
 752 {
 753         NTSTATUS err;
 754         const char *msg = (const char *)data->data;
 755         struct blocking_lock_record *blr;
 756
 757         if (data->data == NULL) {
 758                 smb_panic("process_blocking_lock_cancel_message: null msg");
 759         }
 760
 761         if (data->length != MSG_BLOCKING_LOCK_CANCEL_SIZE) {
 762                 DEBUG(0, ("process_blocking_lock_cancel_message: "
 763                           "Got invalid msg len %d\n", (int)data->length));
 764                 smb_panic("process_blocking_lock_cancel_message: bad msg");
 765         }
 766
 767         memcpy(&blr, msg, sizeof(blr));
 768         memcpy(&err, &msg[sizeof(blr)], sizeof(NTSTATUS));
 769
 770         DEBUG(10,("process_blocking_lock_cancel_message: returning error %s\n",
 771                 nt_errstr(err) ));
 772
 773         blocking_lock_reply_error(blr, err);
 774         DLIST_REMOVE(blocking_lock_cancelled_queue, blr);
 775         TALLOC_FREE(blr);
 776 }
 777
 778 /****************************************************************************
 779  Send ourselves a blocking lock cancelled message. Handled asynchronously above.
 780  Returns the blocking_lock_record that is being cancelled.
 781 *****************************************************************************/
 782
 783 struct blocking_lock_record *blocking_lock_cancel(files_struct *fsp,
 784                         uint32 lock_pid,
 785                         uint64_t offset,
 786                         uint64_t count,
 787                         enum brl_flavour lock_flav,
 788                         unsigned char locktype,
 789                         NTSTATUS err)
 790 {
 791         char msg[MSG_BLOCKING_LOCK_CANCEL_SIZE];
 792         struct blocking_lock_record *blr;
 793
 794         if (!blocking_lock_cancel_state) {
 795                 /* Register our message. */
 796                 messaging_register(smbd_messaging_context(), NULL,
 797                                    MSG_SMB_BLOCKING_LOCK_CANCEL,
 798                                    process_blocking_lock_cancel_message);
 799
 800                 blocking_lock_cancel_state = True;
 801         }
 802
 803         for (blr = blocking_lock_queue; blr; blr = blr->next) {
 804                 if (fsp == blr->fsp &&
 805                                 lock_pid == blr->lock_pid &&
 806                                 offset == blr->offset &&
 807                                 count == blr->count &&
 808                                 lock_flav == blr->lock_flav) {
 809                         break;
 810                 }
 811         }
 812
 813         if (!blr) {
 814                 return NULL;
 815         }
 816
 817         /* Check the flags are right. */
 818         if (blr->req->cmd == SMBlockingX &&
 819                 (locktype & LOCKING_ANDX_LARGE_FILES) !=
 820                         (CVAL(blr->req->vwv+3, 0) & LOCKING_ANDX_LARGE_FILES)) {
 821                 return NULL;
 822         }
 823
 824         /* Move to cancelled queue. */
 825         DLIST_REMOVE(blocking_lock_queue, blr);
 826         DLIST_ADD(blocking_lock_cancelled_queue, blr);
 827
 828         /* Create the message. */
 829         memcpy(msg, &blr, sizeof(blr));
 830         memcpy(&msg[sizeof(blr)], &err, sizeof(NTSTATUS));
 831
 832         messaging_send_buf(smbd_messaging_context(), procid_self(),
 833                            MSG_SMB_BLOCKING_LOCK_CANCEL,
 834                            (uint8 *)&msg, sizeof(msg));
 835
 836         return blr;
 837 }