s3:smb2_notify: fix use after free on long living notify requests
[samba.git] / source3 / smbd / smb2_notify.c
index 20496c1c2c12961e975810b18ac46f4bed6374f1..228346eb989e7d78a9ed0fe7a99c652c798462aa 100644 (file)
@@ -28,7 +28,8 @@
 struct smbd_smb2_notify_state {
        struct smbd_smb2_request *smb2req;
        struct smb_request *smbreq;
-       struct tevent_immediate *im;
+       bool has_request;
+       bool skip_reply;
        NTSTATUS status;
        DATA_BLOB out_output_buffer;
 };
@@ -49,7 +50,6 @@ NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
 {
        NTSTATUS status;
        const uint8_t *inbody;
-       int i = req->current_idx;
        uint16_t in_flags;
        uint32_t in_output_buffer_length;
        uint64_t in_file_id_persistent;
@@ -62,7 +62,7 @@ NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
        if (!NT_STATUS_IS_OK(status)) {
                return smbd_smb2_request_error(req, status);
        }
-       inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
+       inbody = SMBD_SMB2_IN_BODY_PTR(req);
 
        in_flags                = SVAL(inbody, 0x02);
        in_output_buffer_length = IVAL(inbody, 0x04);
@@ -107,7 +107,6 @@ static void smbd_smb2_request_notify_done(struct tevent_req *subreq)
 {
        struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
                                        struct smbd_smb2_request);
-       int i = req->current_idx;
        DATA_BLOB outbody;
        DATA_BLOB outdyn;
        uint16_t out_output_buffer_offset;
@@ -115,24 +114,6 @@ static void smbd_smb2_request_notify_done(struct tevent_req *subreq)
        NTSTATUS status;
        NTSTATUS error; /* transport error */
 
-       if (req->cancelled) {
-               struct smbd_smb2_notify_state *state = tevent_req_data(subreq,
-                                              struct smbd_smb2_notify_state);
-               const uint8_t *inhdr = (const uint8_t *)req->in.vector[i].iov_base;
-               uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
-
-               DEBUG(10,("smbd_smb2_request_notify_done: cancelled mid %llu\n",
-                       (unsigned long long)mid ));
-               error = smbd_smb2_request_error(req, NT_STATUS_CANCELLED);
-               if (!NT_STATUS_IS_OK(error)) {
-                       smbd_server_connection_terminate(req->sconn,
-                               nt_errstr(error));
-                       return;
-               }
-               TALLOC_FREE(state->im);
-               return;
-       }
-
        status = smbd_smb2_notify_recv(subreq,
                                       req,
                                       &out_output_buffer);
@@ -179,11 +160,46 @@ static void smbd_smb2_request_notify_done(struct tevent_req *subreq)
 static void smbd_smb2_notify_reply(struct smb_request *smbreq,
                                   NTSTATUS error_code,
                                   uint8_t *buf, size_t len);
-static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
-                                          struct tevent_immediate *im,
-                                          void *private_data);
 static bool smbd_smb2_notify_cancel(struct tevent_req *req);
 
+static int smbd_smb2_notify_state_destructor(struct smbd_smb2_notify_state *state)
+{
+       if (!state->has_request) {
+               return 0;
+       }
+
+       state->skip_reply = true;
+       smbd_notify_cancel_by_smbreq(state->smbreq);
+       return 0;
+}
+
+static int smbd_smb2_notify_smbreq_destructor(struct smb_request *smbreq)
+{
+       struct tevent_req *req = talloc_get_type_abort(smbreq->async_priv,
+                                                      struct tevent_req);
+       struct smbd_smb2_notify_state *state = tevent_req_data(req,
+                                              struct smbd_smb2_notify_state);
+
+       /*
+        * Our temporary parent from change_notify_add_request()
+        * goes away.
+        */
+       state->has_request = false;
+
+       /*
+        * move it back to its original parent,
+        * which means we no longer need the destructor
+        * to protect it.
+        */
+       talloc_steal(smbreq->smb2req, smbreq);
+       talloc_set_destructor(smbreq, NULL);
+
+       /*
+        * We want to keep smbreq!
+        */
+       return -1;
+}
+
 static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
                                                struct tevent_context *ev,
                                                struct smbd_smb2_request *smb2req,
@@ -195,7 +211,7 @@ static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
        struct tevent_req *req;
        struct smbd_smb2_notify_state *state;
        struct smb_request *smbreq;
-       connection_struct *conn = smb2req->tcon->compat_conn;
+       connection_struct *conn = smb2req->tcon->compat;
        bool recursive = (in_flags & SMB2_WATCH_TREE) ? true : false;
        NTSTATUS status;
 
@@ -207,7 +223,7 @@ static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
        state->smb2req = smb2req;
        state->status = NT_STATUS_INTERNAL_ERROR;
        state->out_output_buffer = data_blob_null;
-       state->im = NULL;
+       talloc_set_destructor(state, smbd_smb2_notify_state_destructor);
 
        DEBUG(10,("smbd_smb2_notify_send: %s - %s\n",
                  fsp_str_dbg(fsp), fsp_fnum_dbg(fsp)));
@@ -220,7 +236,7 @@ static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
        state->smbreq = smbreq;
        smbreq->async_priv = (void *)req;
 
-       {
+       if (DEBUGLEVEL >= 3) {
                char *filter_string;
 
                filter_string = notify_filter_string(NULL, in_completion_filter);
@@ -277,11 +293,6 @@ static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
                return tevent_req_post(req, ev);
        }
 
-       state->im = tevent_create_immediate(state);
-       if (tevent_req_nomem(state->im, req)) {
-               return tevent_req_post(req, ev);
-       }
-
        /*
         * No changes pending, queue the request
         */
@@ -296,6 +307,16 @@ static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
                return tevent_req_post(req, ev);
        }
 
+       /*
+        * This is a HACK!
+        *
+        * change_notify_add_request() talloc_moves()
+        * smbreq away from us, so we need a destructor
+        * which moves it back at the end.
+        */
+       state->has_request = true;
+       talloc_set_destructor(smbreq, smbd_smb2_notify_smbreq_destructor);
+
        /* allow this request to be canceled */
        tevent_req_set_cancel_fn(req, smbd_smb2_notify_cancel);
 
@@ -311,6 +332,10 @@ static void smbd_smb2_notify_reply(struct smb_request *smbreq,
        struct smbd_smb2_notify_state *state = tevent_req_data(req,
                                               struct smbd_smb2_notify_state);
 
+       if (state->skip_reply) {
+               return;
+       }
+
        state->status = error_code;
        if (!NT_STATUS_IS_OK(error_code)) {
                /* nothing */
@@ -323,30 +348,7 @@ static void smbd_smb2_notify_reply(struct smb_request *smbreq,
                }
        }
 
-       if (state->im == NULL) {
-               smbd_smb2_notify_reply_trigger(NULL, NULL, req);
-               return;
-       }
-
-       /*
-        * if this is called async, we need to go via an immediate event
-        * because the caller replies on the smb_request (a child of req
-        * being arround after calling this function
-        */
-       tevent_schedule_immediate(state->im,
-                                 state->smb2req->sconn->ev_ctx,
-                                 smbd_smb2_notify_reply_trigger,
-                                 req);
-}
-
-static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
-                                          struct tevent_immediate *im,
-                                          void *private_data)
-{
-       struct tevent_req *req = talloc_get_type_abort(private_data,
-                                                      struct tevent_req);
-       struct smbd_smb2_notify_state *state = tevent_req_data(req,
-                                              struct smbd_smb2_notify_state);
+       tevent_req_defer_callback(req, state->smb2req->sconn->ev_ctx);
 
        if (!NT_STATUS_IS_OK(state->status)) {
                tevent_req_nterror(req, state->status);
@@ -363,8 +365,6 @@ static bool smbd_smb2_notify_cancel(struct tevent_req *req)
 
        smbd_notify_cancel_by_smbreq(state->smbreq);
 
-       state->smb2req->cancelled = true;
-       tevent_req_done(req);
        return true;
 }