From: Michael Adam <obnox@samba.org>
Date: Wed, 11 Apr 2012 13:51:40 +0000 (+0200)
Subject: s3:registry: fix seqnum race in regdb_fetch_keys_internal
X-Git-Tag: samba-4.0.0alpha20~75
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=22451f7f45c1f692dc9d40af0e6ce82666359390;p=thirdparty%2Fsamba.git

s3:registry: fix seqnum race in regdb_fetch_keys_internal

This prevents race between fetching seqnum and key content.

Because there is currently no way to atomically fetch the
record along with the seqnum, I use a loop.
This is far from optimal and should should ideally be done
differently. But for now it fixes the race.

Signed-off-by: Andreas Schneider <asn@samba.org>
---

diff --git a/source3/registry/reg_backend_db.c b/source3/registry/reg_backend_db.c
index abe9f7bdca5..ed7fe4d116e 100644
--- a/source3/registry/reg_backend_db.c
+++ b/source3/registry/reg_backend_db.c
@@ -1712,6 +1712,7 @@ static WERROR regdb_fetch_keys_internal(struct db_context *db, const char *key,
 	fstring subkeyname;
 	TALLOC_CTX *frame = talloc_stackframe();
 	TDB_DATA value;
+	int seqnum[2], count;
 
 	DEBUG(11,("regdb_fetch_keys: Enter key => [%s]\n", key ? key : "NULL"));
 
@@ -1724,10 +1725,28 @@ static WERROR regdb_fetch_keys_internal(struct db_context *db, const char *key,
 	werr = regsubkey_ctr_reinit(ctr);
 	W_ERROR_NOT_OK_GOTO_DONE(werr);
 
-	werr = regsubkey_ctr_set_seqnum(ctr, dbwrap_get_seqnum(db));
-	W_ERROR_NOT_OK_GOTO_DONE(werr);
+	count = 0;
+	ZERO_STRUCT(value);
+	seqnum[0] = dbwrap_get_seqnum(db);
+
+	do {
+		count++;
+		TALLOC_FREE(value.dptr);
+		value = regdb_fetch_key_internal(db, frame, key);
+		seqnum[count % 2] = dbwrap_get_seqnum(db);
 
-	value = regdb_fetch_key_internal(db, frame, key);
+	} while (seqnum[0] != seqnum[1]);
+
+	if (count > 1) {
+		DEBUG(5, ("regdb_fetch_keys_internal: it took %d attempts to "
+			  "fetch key '%s' with constant seqnum\n",
+			  count, key));
+	}
+
+	werr = regsubkey_ctr_set_seqnum(ctr, seqnum[0]);
+	if (!W_ERROR_IS_OK(werr)) {
+		goto done;
+	}
 
 	if (value.dsize == 0 || value.dptr == NULL) {
 		DEBUG(10, ("regdb_fetch_keys: no subkeys found for key [%s]\n",