s3:registry: fix seqnum race in regdb_fetch_keys_internal

This prevents race between fetching seqnum and key content.

Because there is currently no way to atomically fetch the
record along with the seqnum, I use a loop.
This is far from optimal and should should ideally be done
differently. But for now it fixes the race.
(cherry picked from commit 66fcac5e479a530091ecb43d9f8cf90f4351ad17)

diff --git a/source3/registry/reg_backend_db.c b/source3/registry/reg_backend_db.c
index 995da66de661242b20b5464211030789df4b8e5d..68cd094588e89008640e7a5ca0b756651c27e3e3 100644 (file)
--- a/source3/registry/reg_backend_db.c
+++ b/source3/registry/reg_backend_db.c
@@ -1615,6 +1615,7 @@ static WERROR regdb_fetch_keys_internal(struct db_context *db, const char *key,
        fstring subkeyname;
        TALLOC_CTX *frame = talloc_stackframe();
        TDB_DATA value;
+       int seqnum[2], count;
 
        DEBUG(11,("regdb_fetch_keys: Enter key => [%s]\n", key ? key : "NULL"));
 
@@ -1627,10 +1628,28 @@ static WERROR regdb_fetch_keys_internal(struct db_context *db, const char *key,
        werr = regsubkey_ctr_reinit(ctr);
        W_ERROR_NOT_OK_GOTO_DONE(werr);
 
-       werr = regsubkey_ctr_set_seqnum(ctr, db->get_seqnum(db));
-       W_ERROR_NOT_OK_GOTO_DONE(werr);
+       count = 0;
+       ZERO_STRUCT(value);
+       seqnum[0] = db->get_seqnum(db);
+
+       do {
+               count++;
+               TALLOC_FREE(value.dptr);
+               value = regdb_fetch_key_internal(db, frame, key);
+               seqnum[count % 2] = db->get_seqnum(db);
 
-       value = regdb_fetch_key_internal(db, frame, key);
+       } while (seqnum[0] != seqnum[1]);
+
+       if (count > 1) {
+               DEBUG(5, ("regdb_fetch_keys_internal: it took %d attempts to "
+                         "fetch key '%s' with constant seqnum\n",
+                         count, key));
+       }
+
+       werr = regsubkey_ctr_set_seqnum(ctr, seqnum[0]);
+       if (!W_ERROR_IS_OK(werr)) {
+               goto done;
+       }
 
        if (value.dsize == 0 || value.dptr == NULL) {
                DEBUG(10, ("regdb_fetch_keys: no subkeys found for key [%s]\n",