Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-84115

fd_handle_destructor() can panic within an smbd_smb2_close()

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • rhel-9.6
    • rhel-9.5
    • samba
    • No
    • None
    • rhel-sst-idm-sssd
    • rhel-sst-idm-sssd
    • ssg_idm
    • 1
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      In fd_openat() if fsp_flags.fstat_before_close == true then close_file_smb will call
      vfs_stat which can fail. If it does fail then the fd associated with the file handle will still be set (and we will hit an assert is the file handle destructor) when calling file_free.
      We need to set fd to -1 to avoid that. To achieve that we capture and return the vfs_stat_fsp failure status while still processing the rest of the fd_close logic.

      [2024/02/20 09:23:48.454671,  0, pid=9744] ../../source3/smbd/smb2_close.c:226(smbd_smb2_close)
        smbd_smb2_close: close_file[]: NT_STATUS_ACCESS_DENIED
      [2024/02/20 09:23:48.454757,  0, pid=9744] ../../source3/smbd/fd_handle.c:40(fd_handle_destructor)
        PANIC: assert failed at ../../source3/smbd/fd_handle.c(40): (fh->fd == -1) || (fh->fd == AT_FDCWD)
      [2024/02/20 09:23:48.454781,  0, pid=9744] ../../lib/util/fault.c:178(smb_panic_log)
        ===============================================================
      [2024/02/20 09:23:48.454804,  0, pid=9744] ../../lib/util/fault.c:185(smb_panic_log)
        INTERNAL ERROR: assert failed: (fh->fd == -1) || (fh->fd == AT_FDCWD) in smbd (smbd[192.168.10) (client [192.168.100.15]) pid 9744 (4.21.0pre1-DEVELOPERBUILD)
      [2024/02/20 09:23:48.454844,  0, pid=9744] ../../lib/util/fault.c:190(smb_panic_log)
        If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting
      [2024/02/20 09:23:48.454869,  0, pid=9744] ../../lib/util/fault.c:191(smb_panic_log)
      

              anschnei@redhat.com Andreas Schneider
              anschnei@redhat.com Andreas Schneider
              Andreas Schneider Andreas Schneider
              Anuj Borah Anuj Borah
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: