[SCM] Samba Shared Repository - branch master updated
Anoop C S
anoopcs at samba.org
Tue Sep 1 17:36:01 UTC 2026
The branch, master has been updated
via 000b0788749 s4:nbench: Fix whitespace issues in nbio.c
via bbad7212ead s4:nbench: Fix potential NULL dereference on exit
via d62555878ae s4:kdc: Fix NULL dereference caused by an allocation error
via b545b91f867 s3:utils: Fix buffer underflow by sharepath
via ea5a39c7706 s3/smbd: fix ignored error in create_conn_struct_as_root
from 43ad97b33ba ctdb-common: Fix CID 1700569: Memory - corruptions (OVERRUN)
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 000b0788749fffd4a8600c7005757c299a92752f
Author: Anoop C S <anoopcs at samba.org>
Date: Fri Aug 28 22:36:47 2026 +0530
s4:nbench: Fix whitespace issues in nbio.c
Based-on-a-patch-by: Linar Galimov <galimovlz at sgu.ru>
Signed-off-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
Autobuild-User(master): Anoop C S <anoopcs at samba.org>
Autobuild-Date(master): Tue Sep 1 17:35:10 UTC 2026 on atb-devel-224
commit bbad7212ead21f05ed962d0c6ee2e05e2cb133a9
Author: Anoop C S <anoopcs at samba.org>
Date: Fri Aug 28 22:37:03 2026 +0530
s4:nbench: Fix potential NULL dereference on exit
Within nbio_shmem(), anonymous_shared_allocate() is used to allocate memory for
children. If it fails, NULL can be assigned to children. Subsequently, nb_exit()
can be called in this case, dereferencing children & resulting in a NULL deref.
This patch fixes the potential issue by only dereferencing children if it is not
actually NULL.
Based-on-a-patch-by: Linar Galimov <galimovlz at sgu.ru>
Based-on-a-patch-by: Sergey Zhidkih <zhidkihsv at basealt.ru>
Signed-off-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
commit d62555878ae4fe216f10b16bec80fe170b85df08
Author: Shishkov Nikita <shishkovna at sgu.ru>
Date: Mon Jun 29 20:02:32 2026 +0400
s4:kdc: Fix NULL dereference caused by an allocation error
mit_samba_context_init() calls mit_samba_context_free() with a NULL
context when the initial allocation fails.
Attach a talloc destructor to struct mit_samba_context to release the MIT
krb5 context, and use TALLOC_FREE() for context cleanup. This makes the
failure path NULL-safe and ties the MIT context lifetime to its talloc
context.
Pair-Programmed-With: Dmitriy Mikhalchenko <tascad at altlinux.org>
Signed-off-by: Shishkov Nikita <shishkovna at sgu.ru>
Signed-off-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
commit b545b91f8671b15ceeea1a03ce35b96a5f6e1d46
Author: Shishkov Nikita <shishkovna at sgu.ru>
Date: Mon Jun 29 19:58:54 2026 +0400
s3:utils: Fix buffer underflow by sharepath
print_brl_json() indexes the final byte of sharepath without first
checking whether the string is empty.
Return failure for an empty share path instead of accessing memory
before the start of the buffer.
Pair-Programmed-With: Dina Tagantseva <dinchik at altlinux.org>
Signed-off-by: Shishkov Nikita <shishkovna at sgu.ru>
Signed-off-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
commit ea5a39c770634cd5ea24f2f36f57d9abfda973ed
Author: Egor Mikhailov <mikhailovev at sgu.ru>
Date: Wed Jun 17 10:07:14 2026 +0400
s3/smbd: fix ignored error in create_conn_struct_as_root
create_conn_struct_as_root() ignored the return value of
set_conn_connectpath(), unlike its other callers.
Check the return value and return NT_STATUS_BAD_NETWORK_NAME
instead of continuing with an invalid or incompletely initialized
connection path.
Pair-Programmed-With: Sergey Zhidkih <rx1513 at altlinux.org>
Signed-off-by: Egor Mikhailov <mikhailovev at sgu.ru>
Signed-off-by: Anoop C S <anoopcs at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
-----------------------------------------------------------------------
Summary of changes:
source3/smbd/msdfs.c | 7 ++++-
source3/utils/status_json.c | 6 +++-
source4/kdc/mit-kdb/kdb_samba.c | 2 +-
source4/kdc/mit_samba.c | 11 ++++---
source4/kdc/mit_samba.h | 2 --
source4/torture/nbench/nbio.c | 68 +++++++++++++++++++++--------------------
6 files changed, 53 insertions(+), 43 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c
index e6a46432825..0b031b4d29c 100644
--- a/source3/smbd/msdfs.c
+++ b/source3/smbd/msdfs.c
@@ -255,7 +255,12 @@ static NTSTATUS create_conn_struct_as_root(
conn_setup_case_options(conn);
- set_conn_connectpath(conn, connpath);
+ ok = set_conn_connectpath(conn, connpath);
+ if (!ok) {
+ DBG_ERR("Failed to set connectpath for service\n");
+ TALLOC_FREE(conn);
+ return NT_STATUS_BAD_NETWORK_NAME;
+ }
/*
* New code to check if there's a share security descriptor
diff --git a/source3/utils/status_json.c b/source3/utils/status_json.c
index cfc12180cae..538af9e592a 100644
--- a/source3/utils/status_json.c
+++ b/source3/utils/status_json.c
@@ -1358,13 +1358,17 @@ int print_brl_json(struct traverse_state *state,
};
int result = 0;
char *key;
+ size_t sharepath_len = strlen(sharepath);
TALLOC_CTX *tmp_ctx = talloc_stackframe();
if (tmp_ctx == NULL) {
return -1;
}
- if (sharepath[strlen(sharepath)-1] == '/') {
+ if (sharepath_len == 0) {
+ goto failure;
+ }
+ if (sharepath[sharepath_len - 1] == '/') {
key = talloc_asprintf(tmp_ctx, "%s%s", sharepath, filename);
} else {
key = talloc_asprintf(tmp_ctx, "%s/%s", sharepath, filename);
diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c
index e8fcfc87471..e1f0fa731f6 100644
--- a/source4/kdc/mit-kdb/kdb_samba.c
+++ b/source4/kdc/mit-kdb/kdb_samba.c
@@ -70,7 +70,7 @@ static krb5_error_code kdb_samba_fini_module(krb5_context context)
return 0;
}
- mit_samba_context_free(mit_ctx);
+ TALLOC_FREE(mit_ctx);
return 0;
}
diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 4f97b829919..d9d4cf5cf61 100644
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -45,15 +45,15 @@
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_KERBEROS
-void mit_samba_context_free(struct mit_samba_context *ctx)
+static int mit_samba_context_destructor(struct mit_samba_context *ctx)
{
/* free MIT's krb5_context */
- if (ctx->context) {
+ if (ctx->context != NULL) {
krb5_free_context(ctx->context);
+ ctx->context = NULL;
}
- /* then free everything else */
- talloc_free(ctx);
+ return 0;
}
/*
@@ -85,6 +85,7 @@ krb5_error_code mit_samba_context_init(struct mit_samba_context **_ctx)
ret = ENOMEM;
goto done;
}
+ talloc_set_destructor(ctx, mit_samba_context_destructor);
base_ctx.ev_ctx = tevent_context_init(ctx);
if (!base_ctx.ev_ctx) {
@@ -138,7 +139,7 @@ krb5_error_code mit_samba_context_init(struct mit_samba_context **_ctx)
done:
if (ret) {
- mit_samba_context_free(ctx);
+ TALLOC_FREE(ctx);
} else {
*_ctx = ctx;
}
diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
index 03574084614..afa896a96f1 100644
--- a/source4/kdc/mit_samba.h
+++ b/source4/kdc/mit_samba.h
@@ -30,8 +30,6 @@ struct mit_samba_context {
int mit_samba_context_init(struct mit_samba_context **_ctx);
-void mit_samba_context_free(struct mit_samba_context *ctx);
-
int mit_samba_generate_salt(krb5_data *salt);
int mit_samba_generate_random_password(krb5_data *pwd);
diff --git a/source4/torture/nbench/nbio.c b/source4/torture/nbench/nbio.c
index 1de988e7a06..0d8b76b145f 100644
--- a/source4/torture/nbench/nbio.c
+++ b/source4/torture/nbench/nbio.c
@@ -3,21 +3,21 @@
*/
-/*
+/*
Unix SMB/CIFS implementation.
SMB torture tester
Copyright (C) Andrew Tridgell 1997-1998
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
@@ -203,7 +203,7 @@ void nbio_target_rate(double rate)
void nbio_time_reset(void)
{
- children[nbio_id].starttime = timeval_current();
+ children[nbio_id].starttime = timeval_current();
}
void nbio_time_delay(double targett)
@@ -292,23 +292,23 @@ void nb_alarm(int sig)
}
if (in_warmup) {
- printf("%4d %8d %.2f MB/sec warmup %.0f sec \n",
- num_connected, lines/nprocs,
+ printf("%4d %8d %.2f MB/sec warmup %.0f sec \n",
+ num_connected, lines/nprocs,
nbio_result(), t);
} else if (in_cleanup) {
- printf("%4d %8d %.2f MB/sec cleanup %.0f sec \n",
- num_connected, lines/nprocs,
+ printf("%4d %8d %.2f MB/sec cleanup %.0f sec \n",
+ num_connected, lines/nprocs,
nbio_result(), t);
} else {
- printf("%4d %8d %.2f MB/sec execute %.0f sec latency %.2f msec \n",
- num_connected, lines/nprocs,
+ printf("%4d %8d %.2f MB/sec execute %.0f sec latency %.2f msec \n",
+ num_connected, lines/nprocs,
nbio_result(), t, nbio_latency() * 1.0e3);
}
fflush(stdout);
next:
signal(SIGALRM, nb_alarm);
- alarm(1);
+ alarm(1);
}
void nbio_shmem(int n, int t_timelimit, int t_warmup)
@@ -366,7 +366,7 @@ static int find_handle(int handle, struct ftable **f_ret)
*f_ret = f;
return f->fd;
}
- printf("(%d) ERROR: handle %d was not found\n",
+ printf("(%d) ERROR: handle %d was not found\n",
nbench_line_count, handle);
nb_exit(1);
@@ -380,7 +380,7 @@ static struct smbcli_state *c;
/*
a handler function for oplock break requests
*/
-static bool oplock_handler(struct smbcli_transport *transport, uint16_t tid,
+static bool oplock_handler(struct smbcli_transport *transport, uint16_t tid,
uint16_t fnum, uint8_t level, void *private_data)
{
struct smbcli_tree *tree = (struct smbcli_tree *)private_data;
@@ -406,20 +406,20 @@ static bool check_status(const char *op, NTSTATUS status, NTSTATUS ret)
{
if ((NT_STATUS_EQUAL(ret, NT_STATUS_END_OF_FILE) ||
NT_STATUS_EQUAL(ret, NT_STATUS_NET_WRITE_FAULT) ||
- NT_STATUS_EQUAL(ret, NT_STATUS_CONNECTION_RESET))
+ NT_STATUS_EQUAL(ret, NT_STATUS_CONNECTION_RESET))
&& !NT_STATUS_EQUAL (status, ret))
{
return false;
}
if (!NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(ret)) {
- printf("[%d] Error: %s should have failed with %s\n",
+ printf("[%d] Error: %s should have failed with %s\n",
nbench_line_count, op, nt_errstr(status));
nb_exit(1);
}
if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ret)) {
- printf("[%d] Error: %s should have succeeded - %s\n",
+ printf("[%d] Error: %s should have succeeded - %s\n",
nbench_line_count, op, nt_errstr(ret));
nb_exit(1);
}
@@ -461,7 +461,7 @@ static bool nb_do_createx(struct ftable *f,
NTSTATUS status,
bool retry)
{
- union smb_open io;
+ union smb_open io;
uint32_t desired_access;
NTSTATUS ret;
TALLOC_CTX *mem_ctx;
@@ -472,13 +472,13 @@ static bool nb_do_createx(struct ftable *f,
if (create_options & NTCREATEX_OPTIONS_DIRECTORY) {
desired_access = SEC_FILE_READ_DATA;
} else {
- desired_access =
- SEC_FILE_READ_DATA |
+ desired_access =
+ SEC_FILE_READ_DATA |
SEC_FILE_WRITE_DATA |
SEC_FILE_READ_ATTRIBUTE |
SEC_FILE_WRITE_ATTRIBUTE;
flags = NTCREATEX_FLAGS_EXTENDED |
- NTCREATEX_FLAGS_REQUEST_OPLOCK |
+ NTCREATEX_FLAGS_REQUEST_OPLOCK |
NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
}
@@ -530,7 +530,7 @@ static bool nb_do_createx(struct ftable *f,
return true;
}
-bool nb_createx(const char *fname,
+bool nb_createx(const char *fname,
unsigned int create_options, unsigned int create_disposition, int handle,
NTSTATUS status)
{
@@ -568,10 +568,10 @@ bool nb_writex(int handle, off_t offset, int size, int ret_size, NTSTATUS status
return false;
if (NT_STATUS_IS_OK(ret) && io.writex.out.nwritten != ret_size) {
- printf("[%d] Warning: WriteX got count %d expected %d\n",
+ printf("[%d] Warning: WriteX got count %d expected %d\n",
nbench_line_count,
io.writex.out.nwritten, ret_size);
- }
+ }
children[nbio_id].bytes += ret_size;
@@ -609,10 +609,10 @@ bool nb_write(int handle, off_t offset, int size, int ret_size, NTSTATUS status)
return false;
if (NT_STATUS_IS_OK(ret) && io.write.out.nwritten != ret_size) {
- printf("[%d] Warning: Write got count %d expected %d\n",
+ printf("[%d] Warning: Write got count %d expected %d\n",
nbench_line_count,
io.write.out.nwritten, ret_size);
- }
+ }
children[nbio_id].bytes += ret_size;
@@ -734,11 +734,11 @@ bool nb_readx(int handle, off_t offset, int size, int ret_size, NTSTATUS status)
return false;
if (NT_STATUS_IS_OK(ret) && io.readx.out.nread != ret_size) {
- printf("[%d] ERROR: ReadX got count %d expected %d\n",
+ printf("[%d] ERROR: ReadX got count %d expected %d\n",
nbench_line_count,
io.readx.out.nread, ret_size);
nb_exit(1);
- }
+ }
children[nbio_id].bytes += ret_size;
@@ -898,8 +898,8 @@ bool nb_qfsinfo(int level, NTSTATUS status)
ret = smb_raw_fsinfo(c->tree, mem_ctx, &io);
talloc_free(mem_ctx);
-
- return check_status("Fsinfo", status, ret);
+
+ return check_status("Fsinfo", status, ret);
}
/* callback function used for trans2 search */
@@ -923,7 +923,7 @@ bool nb_findfirst(const char *mask, int level, int maxcnt, int count, NTSTATUS s
io.t2ffirst.in.pattern = mask;
io.t2ffirst.in.flags = FLAG_TRANS2_FIND_CLOSE;
io.t2ffirst.in.storage_type = 0;
-
+
ret = smb_raw_search_first(c->tree, mem_ctx, &io, NULL, findfirst_callback);
talloc_free(mem_ctx);
@@ -932,7 +932,7 @@ bool nb_findfirst(const char *mask, int level, int maxcnt, int count, NTSTATUS s
return false;
if (NT_STATUS_IS_OK(ret) && io.t2ffirst.out.count != count) {
- printf("[%d] Warning: got count %d expected %d\n",
+ printf("[%d] Warning: got count %d expected %d\n",
nbench_line_count,
io.t2ffirst.out.count, count);
}
@@ -987,7 +987,9 @@ bool nb_deltree(const char *dname, bool retry)
void nb_exit(int status)
{
- children[nbio_id].connected = false;
+ if (children != NULL) {
+ children[nbio_id].connected = false;
+ }
printf("[%d] client %d exiting with status %d\n",
nbench_line_count, nbio_id, status);
exit(status);
--
Samba Shared Repository
More information about the samba-cvs
mailing list