From: Ralph Boehme <slow@samba.org>
Date: Wed, 10 Jun 2020 13:21:35 +0000 (+0200)
Subject: smbd: maintain correct destructor order in fsp_free()
X-Git-Tag: samba-4.14.0rc1~367
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d5edf302c9ca1a48927c8a6db780b8e193edfd05;p=thirdparty%2Fsamba.git

smbd: maintain correct destructor order in fsp_free()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/source3/smbd/files.c b/source3/smbd/files.c
index 350a2bf85e0..fb3934867b1 100644
--- a/source3/smbd/files.c
+++ b/source3/smbd/files.c
@@ -919,6 +919,18 @@ void fsp_free(files_struct *fsp)
 
 	fsp->conn->num_files_open--;
 
+	if (fsp->fsp_name != NULL &&
+	    fsp->fsp_name->fsp_link != NULL)
+	{
+		/*
+		 * Free fsp_link of fsp->fsp_name. To do this in the correct
+		 * talloc destructor order we have to do it here. The
+		 * talloc_free() of the link should set the fsp pointer to NULL.
+		 */
+		TALLOC_FREE(fsp->fsp_name->fsp_link);
+		SMB_ASSERT(fsp->fsp_name->fsp == NULL);
+	}
+
 	/* this is paranoia, just in case someone tries to reuse the
 	   information */
 	ZERO_STRUCTP(fsp);