Ensure we correctly setup req->subreq before testing for async. Stops crashes when

XX_send functions set async to stop interim replies being sent.

Jeremy.

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index d7be0deb09b0fcfa32c7765c0103bd28e7f35e59..a8104a13944cd4eda4054b23c9f2c1b8c8ef2cec 100644 (file)
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -701,6 +701,9 @@ NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
                return NT_STATUS_OK;
        }
 
+       req->subreq = subreq;
+       subreq = NULL;
+
        if (req->async) {
                /* We're already async. */
                return NT_STATUS_OK;
@@ -712,14 +715,11 @@ NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
                 * request chain. This is not allowed.
                 * Cancel the outstanding request.
                 */
-               tevent_req_cancel(subreq);
+               tevent_req_cancel(req->subreq);
                return smbd_smb2_request_error(req,
                        NT_STATUS_INSUFFICIENT_RESOURCES);
        }
 
-       req->subreq = subreq;
-       subreq = NULL;
-
        if (DEBUGLEVEL >= 10) {
                dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
                        (unsigned int)req->current_idx );