smbd: maintain correct destructor order in fsp_free()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/smbd/files.c b/source3/smbd/files.c
index 350a2bf85e0ec148129e844f4ff3162d694dd0d2..fb3934867b12aba803def5e40fb95a1a2adbda03 100644 (file)
--- a/source3/smbd/files.c
+++ b/source3/smbd/files.c
@@ -919,6 +919,18 @@ void fsp_free(files_struct *fsp)
 
        fsp->conn->num_files_open--;
 
+       if (fsp->fsp_name != NULL &&
+           fsp->fsp_name->fsp_link != NULL)
+       {
+               /*
+                * Free fsp_link of fsp->fsp_name. To do this in the correct
+                * talloc destructor order we have to do it here. The
+                * talloc_free() of the link should set the fsp pointer to NULL.
+                */
+               TALLOC_FREE(fsp->fsp_name->fsp_link);
+               SMB_ASSERT(fsp->fsp_name->fsp == NULL);
+       }
+
        /* this is paranoia, just in case someone tries to reuse the
           information */
        ZERO_STRUCTP(fsp);