smbd: reset dangling watch_req pointer in poll_open_done

We just freed subreq and a pointer to subreq is stored in open_rec->watch_req,
so we must invalidate the pointer.

Otherwise if the poll open timer fires it will do a

  TALLOC_FREE(open_rec->watch_req);

on the dangling pointer which may crash or do something worse like freeing some
other random talloc memory.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14672
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1843

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 5b3dc246e8a253a661d65dac88215f2855369360..fd4536b4914da9e7294d9d7221bab52b24271436 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -3040,6 +3040,8 @@ static void poll_open_done(struct tevent_req *subreq)
 
        status = share_mode_watch_recv(subreq, NULL, NULL);
        TALLOC_FREE(subreq);
+       open_rec->watch_req = NULL;
+
        DBG_DEBUG("dbwrap_watched_watch_recv returned %s\n",
                  nt_errstr(status));