[SCM] Samba Shared Repository - branch v4-19-test updated

[Jule Anger]

The branch, v4-19-test has been updated
       via  e7f91e1d22b vfs_aio_pthread: fix segfault if samba-tool ntacl get
      from  68db9b7390b dsdb: Use samdb_system_container_dn() in pdb_samba_dsdb_*()

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-19-test


- Log -----------------------------------------------------------------
commit e7f91e1d22b60069af9081dedd1b244273322ea3
Author: Jones Syue <jonessyue at qnap.com>
Date:   Wed Aug 2 09:48:40 2023 +0800

    vfs_aio_pthread: fix segfault if samba-tool ntacl get
    
    If configured as AD DC and aio_pthread appended into 'vfs objects'[1],
    run these commands would get segfault:
    1. sudo samba-tool ntacl get .
    2. sudo net vfs getntacl sysvol .
    gdb said it goes through aio_pthread_openat_fn() @ vfs_aio_pthread.c[2],
    and the fsp->conn->sconn->client is null (0x0).
    
    'sconn->client' memory is allocated when a new connection is accpeted:
    smbd_accept_connection > smbd_process > smbXsrv_client_create
    While running local commands looks like it would not go through
    smbXsrv_client_create so the 'client' is null, segfault might happen.
    We should not dereference 'client->server_multi_channel_enabled',
    if 'client' is null.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=15441
    
    [1] smb.conf example, samba-4.18.5, ubuntu 22.04.2
    [global]
            dns forwarder = 127.0.0.53
            netbios name = U22-JONES-88X1
            realm = U22-JONES-88X1.X88X1.JONES
            server role = active directory domain controller
            workgroup = X88X1
            idmap_ldb:use rfc2307 = yes
            vfs objects = dfs_samba4 acl_xattr aio_pthread
    
    [sysvol]
            path = /var/lib/samba/sysvol
            read only = No
    
    [netlogon]
            path = /var/lib/samba/sysvol/u22-jones-88x1.x88x1.jones/scripts
            read only = No
    
    [2] gdb
    (gdb) run /usr/local/samba/bin/samba-tool ntacl get .
    Starting program: /usr/local/Python3/bin/python3 /usr/local/samba/bin/samba-tool ntacl get .
    [Thread debugging using libthread_db enabled]
    Using host libthread_db library "/lib/libthread_db.so.1".
    
    Program received signal SIGSEGV, Segmentation fault.
    0x00007fffd0eb809e in aio_pthread_openat_fn (handle=0x8d5cc0, dirfsp=0x8c3070, smb_fname=0x18ab4f0, fsp=0x1af3550, flags=196608, mode=0)
        at ../../source3/modules/vfs_aio_pthread.c:467
    warning: Source file is more recent than executable.
    467             if (fsp->conn->sconn->client->server_multi_channel_enabled) {
    (gdb) bt
        at ../../source3/modules/vfs_aio_pthread.c:467
        at ../../source3/smbd/pysmbd.c:320
    ---Type <return> to continue, or q <return> to quit---
    (gdb) f
        at ../../source3/modules/vfs_aio_pthread.c:467
    467             if (fsp->conn->sconn->client->server_multi_channel_enabled) {
    (gdb) p fsp->conn->sconn->client
    $1 = (struct smbXsrv_client *) 0x0
    (gdb)
    
    Signed-off-by: Jones Syue <jonessyue at qnap.com>
    Reviewed-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>
    (cherry picked from commit 8f4c1c67b4f118a9a47b09ac7908cd3d969b19c2)
    
    Autobuild-User(v4-19-test): Jule Anger <janger at samba.org>
    Autobuild-Date(v4-19-test): Thu Aug  3 09:45:34 UTC 2023 on atb-devel-224

-----------------------------------------------------------------------

Summary of changes:
 source3/modules/vfs_aio_pthread.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/source3/modules/vfs_aio_pthread.c b/source3/modules/vfs_aio_pthread.c
index 428ae5f2a4c..0303ff04bc9 100644
--- a/source3/modules/vfs_aio_pthread.c
+++ b/source3/modules/vfs_aio_pthread.c
@@ -475,7 +475,8 @@ static int aio_pthread_openat_fn(vfs_handle_struct *handle,
 		aio_allow_open = false;
 	}
 
-	if (fsp->conn->sconn->client->server_multi_channel_enabled) {
+	if (fsp->conn->sconn->client != NULL &&
+	    fsp->conn->sconn->client->server_multi_channel_enabled) {
 		/*
 		 * This module is not compatible with multi channel yet.
 		 */


-- 
Samba Shared Repository