svn commit: samba r2618 - in branches/SAMBA_4_0/source: include smb_server

[tridge at samba.org]

Author: tridge
Date: 2004-09-25 08:16:16 +0000 (Sat, 25 Sep 2004)
New Revision: 2618

WebSVN: http://websvn.samba.org/websvn/changeset.php?rep=samba&path=/branches/SAMBA_4_0/source&rev=2618&nolog=1

Log:
before we had refererence counts in talloc I added a hack in the
server side request structure to prevent a structing being freed in
some circumstances. This change replaces this with the much more
robust mechanism of talloc_increase_ref_count().

Modified:
   branches/SAMBA_4_0/source/include/smb.h
   branches/SAMBA_4_0/source/smb_server/nttrans.c
   branches/SAMBA_4_0/source/smb_server/reply.c
   branches/SAMBA_4_0/source/smb_server/request.c
   branches/SAMBA_4_0/source/smb_server/trans2.c


Changeset:
Modified: branches/SAMBA_4_0/source/include/smb.h
===================================================================
--- branches/SAMBA_4_0/source/include/smb.h	2004-09-25 08:14:05 UTC (rev 2617)
+++ branches/SAMBA_4_0/source/include/smb.h	2004-09-25 08:16:16 UTC (rev 2618)
@@ -607,7 +607,6 @@
 
 
 /* a set of flags to control handling of request structures */
-#define REQ_CONTROL_PROTECTED (1<<0) /* don't destroy this request */
 #define REQ_CONTROL_LARGE     (1<<1) /* allow replies larger than max_xmit */
 #define REQ_CONTROL_ASYNC     (1<<2) /* the backend will answer this one later */
 

Modified: branches/SAMBA_4_0/source/smb_server/nttrans.c
===================================================================
--- branches/SAMBA_4_0/source/smb_server/nttrans.c	2004-09-25 08:14:05 UTC (rev 2617)
+++ branches/SAMBA_4_0/source/smb_server/nttrans.c	2004-09-25 08:16:16 UTC (rev 2618)
@@ -198,8 +198,6 @@
 	params      = trans.out.params.data;
 	data        = trans.out.data.data;
 
-	req->control_flags |= REQ_CONTROL_PROTECTED;
-
 	/* we need to divide up the reply into chunks that fit into
 	   the negotiated buffer size */
 	do {
@@ -254,9 +252,9 @@
 		params += this_param;
 		data += this_data;
 
-		/* if this is the last chunk then the request can be destroyed */
-		if (params_left == 0 && data_left == 0) {
-			req->control_flags &= ~REQ_CONTROL_PROTECTED;
+		/* don't destroy unless this is the last segment */
+		if (params_left != 0 || data_left != 0) {
+			talloc_increase_ref_count(req);
 		}
 
 		req_send_reply(req);

Modified: branches/SAMBA_4_0/source/smb_server/reply.c
===================================================================
--- branches/SAMBA_4_0/source/smb_server/reply.c	2004-09-25 08:14:05 UTC (rev 2617)
+++ branches/SAMBA_4_0/source/smb_server/reply.c	2004-09-25 08:16:16 UTC (rev 2618)
@@ -1332,13 +1332,9 @@
 
 	memcpy(req->out.data, req->in.data, req->in.data_size);
 
-	/* we need to make sure the request isn't destroyed till the
-	 * last packet */
-	req->control_flags |= REQ_CONTROL_PROTECTED;
-
 	for (i=1; i <= count;i++) {
-		if (i == count) {
-			req->control_flags &= ~REQ_CONTROL_PROTECTED;
+		if (i != count) {
+			talloc_increase_ref_count(req);
 		}
 
 		SSVAL(req->out.vwv, VWV(0), i);

Modified: branches/SAMBA_4_0/source/smb_server/request.c
===================================================================
--- branches/SAMBA_4_0/source/smb_server/request.c	2004-09-25 08:14:05 UTC (rev 2617)
+++ branches/SAMBA_4_0/source/smb_server/request.c	2004-09-25 08:16:16 UTC (rev 2618)
@@ -30,12 +30,6 @@
 /* destroy a request structure */
 void req_destroy(struct smbsrv_request *req)
 {
-	/* the request might be marked protected. This is done by the
-	 * SMBecho code for example */
-	if (req->control_flags & REQ_CONTROL_PROTECTED) {
-		return;
-	}
-
 	/* ahh, its so nice to destroy a complex structure in such a
 	 * simple way! */
 	talloc_free(req);

Modified: branches/SAMBA_4_0/source/smb_server/trans2.c
===================================================================
--- branches/SAMBA_4_0/source/smb_server/trans2.c	2004-09-25 08:14:05 UTC (rev 2617)
+++ branches/SAMBA_4_0/source/smb_server/trans2.c	2004-09-25 08:16:16 UTC (rev 2618)
@@ -1323,8 +1323,6 @@
 	params      = trans.out.params.data;
 	data        = trans.out.data.data;
 
-	req->control_flags |= REQ_CONTROL_PROTECTED;
-
 	/* we need to divide up the reply into chunks that fit into
 	   the negotiated buffer size */
 	do {
@@ -1384,9 +1382,9 @@
 		params += this_param;
 		data += this_data;
 
-		/* if this is the last chunk then the request can be destroyed */
-		if (params_left == 0 && data_left == 0) {
-			req->control_flags &= ~REQ_CONTROL_PROTECTED;
+		/* don't destroy unless this is the last chunk */
+		if (params_left != 0 || data_left != 0) {
+			talloc_increase_ref_count(req);
 		}
 
 		req_send_reply(req);