From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 12 Mar 2021 17:34:06 +0000 (+0100)
Subject: smb2_server: let smbd_smb2_flush_send_queue() destroy pending elements on dead connection
X-Git-Tag: tevent-0.11.0~1368
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=01b675ab323a73fc0cf25cd0bf706dbc1dde514b;p=thirdparty%2Fsamba.git

smb2_server: let smbd_smb2_flush_send_queue() destroy pending elements on dead connection

Otherwise we'll keep the state of already finished requests arround.

This becomes critical as the next commit will cause us to
let pending requests running and keep the xconn alive for
the lifetime of pending requests, so we would not ever
make progress and deadlock.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index d9de7f4ab06..930a4201359 100644
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -4604,6 +4604,18 @@ static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn)
 		bool ok;
 		struct msghdr msg;
 
+		if (!NT_STATUS_IS_OK(xconn->transport.status)) {
+			/*
+			 * we're not supposed to do any io
+			 * just flush all pending stuff.
+			 */
+			xconn->smb2.send_queue_len--;
+			DLIST_REMOVE(xconn->smb2.send_queue, e);
+
+			talloc_free(e->mem_ctx);
+			continue;
+		}
+
 		if (e->sendfile_header != NULL) {
 			size_t size = 0;
 			size_t i = 0;