s3: smbd: Fix mkdir race condition.

Found by Max of LoadDynamix <adx.forum@gmail.com>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11486

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit b1c823dc8c2824ec89921601d8e5e95f6d18fca8)

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 809fa352dfce31e75e7d81042f46ae1049cd647a..162e8347b9405aa4806a4cd6fec6e1ca470130d5 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -3488,6 +3488,25 @@ static NTSTATUS open_directory(connection_struct *conn,
                                                        nt_errstr(status)));
                                                return status;
                                        }
+
+                                       /*
+                                        * If mkdir_internal() returned
+                                        * NT_STATUS_OBJECT_NAME_COLLISION
+                                        * we still must lstat the path.
+                                        */
+
+                                       if (SMB_VFS_LSTAT(conn, smb_dname)
+                                                       == -1) {
+                                               DEBUG(2, ("Could not stat "
+                                                       "directory '%s' just "
+                                                       "opened: %s\n",
+                                                       smb_fname_str_dbg(
+                                                               smb_dname),
+                                                       strerror(errno)));
+                                               return map_nt_error_from_unix(
+                                                               errno);
+                                       }
+
                                        info = FILE_WAS_OPENED;
                                }
                        }