smbXsrv_{open,session,tcon}: protect smbXsrv_{open,session,tcon}_global_traverse_fn...

I saw systems with locking.tdb records being part of:
  ctdb catdb smbXsrv_tcon_global.tdb

It's yet unknown how that happened, but we should not panic in srvsvc_*
calls because the info0 pointer was NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jul  6 11:08:43 UTC 2021 on sn-devel-184

(cherry picked from commit 00bab5b3c821f272153a25ded9743460887a7907)

Autobuild-User(v4-14-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-14-test): Mon Jul 12 13:52:06 UTC 2021 on sn-devel-184

diff --git a/source3/smbd/smbXsrv_open.c b/source3/smbd/smbXsrv_open.c
index 5180315449da281c27069cf88f23c172db19e033..871820ac876448f2222b43ac0701c4bb9fc91b9c 100644 (file)
--- a/source3/smbd/smbXsrv_open.c
+++ b/source3/smbd/smbXsrv_open.c
@@ -1468,6 +1468,15 @@ static NTSTATUS smbXsrv_open_global_parse_record(TALLOC_CTX *mem_ctx,
                goto done;
        }
 
+       if (global_blob.info.info0 == NULL) {
+               status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+               DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
+                        "key '%s' info0 NULL pointer - %s\n",
+                        hex_encode_talloc(frame, key.dptr, key.dsize),
+                        nt_errstr(status)));
+               goto done;
+       }
+
        *global = talloc_move(mem_ctx, &global_blob.info.info0);
        status = NT_STATUS_OK;
 done:

diff --git a/source3/smbd/smbXsrv_session.c b/source3/smbd/smbXsrv_session.c
index 05cf4a095eeed48f48e8a857b4767b160682b08d..066e0ee9e22c424a1650e316307f10751a48738d 100644 (file)
--- a/source3/smbd/smbXsrv_session.c
+++ b/source3/smbd/smbXsrv_session.c
@@ -2235,6 +2235,13 @@ static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
                goto done;
        }
 
+       if (global_blob.info.info0 == NULL) {
+               DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
+                        "key '%s' info0 NULL pointer\n",
+                        hex_encode_talloc(frame, key.dptr, key.dsize)));
+               goto done;
+       }
+
        global_blob.info.info0->db_rec = rec;
        ret = state->fn(global_blob.info.info0, state->private_data);
 done:

diff --git a/source3/smbd/smbXsrv_tcon.c b/source3/smbd/smbXsrv_tcon.c
index d6c2bca0abca19f6f426e33b3f35f230d8388eab..8a0c427597ccb5eaffc26a3790f8c3b162720754 100644 (file)
--- a/source3/smbd/smbXsrv_tcon.c
+++ b/source3/smbd/smbXsrv_tcon.c
@@ -1208,6 +1208,13 @@ static int smbXsrv_tcon_global_traverse_fn(struct db_record *rec, void *data)
                goto done;
        }
 
+       if (global_blob.info.info0 == NULL) {
+               DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
+                        "key '%s' info0 NULL pointer\n",
+                        hex_encode_talloc(frame, key.dptr, key.dsize)));
+               goto done;
+       }
+
        global_blob.info.info0->db_rec = rec;
        ret = state->fn(global_blob.info.info0, state->private_data);
 done: