s3:smb2_server: avoid segfault in smbd_smb2_request_pending_queue()

Because we should not call smbd_smb2_request_error() on an
request that is still running.

If the subreq implementes a cancel function, this should
take care of triggering smbd_smb2_request_error.

metze

Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 9249871f40aab021d62d3154f8ca286b52f5ef76)

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index a595f8063821b4e086ecb4272bb648afec096758..a0e390ed620da450a241519f915d55ce59222d14 100644 (file)
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -947,9 +947,13 @@ NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
                 * request chain. This is not allowed.
                 * Cancel the outstanding request.
                 */
-               tevent_req_cancel(req->subreq);
+               bool ok = tevent_req_cancel(req->subreq);
+               if (ok) {
+                       return NT_STATUS_OK;
+               }
+               TALLOC_FREE(req->subreq);
                return smbd_smb2_request_error(req,
-                       NT_STATUS_INSUFFICIENT_RESOURCES);
+                       NT_STATUS_INTERNAL_ERROR);
        }
 
        if (DEBUGLEVEL >= 10) {