The branch, v4-1-test has been updated via fe52bd4 s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535" via df2ec47 s3:smb2_server: always try to grant the credits the client just consumed from b8a38af dsdb: Add tokenGroupsGlobalAndUniversal, tokenGroups, tokenGroupsNoGCAcceptable
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-1-test - Log ----------------------------------------------------------------- commit fe52bd48a18e1f52d79ec0edfabbb6719412ba55 Author: Stefan Metzmacher <me...@samba.org> Date: Thu Jan 29 10:12:30 2015 +0100 s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535" Bug: https://bugzilla.samba.org/show_bug.cgi?id=9702 Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> Autobuild-User(master): Stefan Metzmacher <me...@samba.org> Autobuild-Date(master): Thu Jan 29 14:58:40 CET 2015 on sn-devel-104 (similar to commit 8aed0fc38ae28cce7fd1a443844a865265fc719c) Autobuild-User(v4-1-test): Stefan Metzmacher <me...@samba.org> Autobuild-Date(v4-1-test): Tue Feb 3 00:04:10 CET 2015 on sn-devel-104 commit df2ec473a6a3a01c2faec01c5a97ed90669a1c9d Author: Stefan Metzmacher <me...@samba.org> Date: Wed Jan 28 15:22:30 2015 +0100 s3:smb2_server: always try to grant the credits the client just consumed It turns out that the effective credits_requested is always at least 1, even if the client sends credits_requested == 0. This means the client is not able to reduce the amount of credits itself. Without this fix a client (e.g. Windows7) would reach the case where it has been granted all credits it asked for. When copying a large file with a lot of parallel requests, all these requests have credits_requested == 0. This means the amount of granted credits where reduced by each request and only when the granted credits reached 0, the server granted one credit to allow the client to go on. The client might require more than one credit ([MS-SMB2] says Windows clients require at least 4 credits) and freezes with just 1 credit. Bug: https://bugzilla.samba.org/show_bug.cgi?id=9702 Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> Reviewed-by: Jeremy Allison <j...@samba.org> (similar to commit 1944c857e59922a2ebfc88a6a824a6ed9396f2d5) ----------------------------------------------------------------------- Summary of changes: source3/smbd/smb2_server.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) Changeset truncated at 500 lines: diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index f7798fa..4f3fa15 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -777,6 +777,7 @@ static void smb2_set_operation_credit(struct smbd_server_connection *sconn, cmd = SVAL(inhdr, SMB2_HDR_OPCODE); credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT); + credits_requested = MAX(credits_requested, 1); out_flags = IVAL(outhdr, SMB2_HDR_FLAGS); out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS)); @@ -795,7 +796,9 @@ static void smb2_set_operation_credit(struct smbd_server_connection *sconn, * credits on the final response. */ credits_granted = 0; - } else if (credits_requested > 0) { + } else { + uint16_t additional_possible = + sconn->smb2.max_credits - credit_charge; uint16_t additional_max = 0; uint16_t additional_credits = credits_requested - 1; @@ -821,14 +824,10 @@ static void smb2_set_operation_credit(struct smbd_server_connection *sconn, break; } + additional_max = MIN(additional_max, additional_possible); additional_credits = MIN(additional_credits, additional_max); credits_granted = credit_charge + additional_credits; - } else if (sconn->smb2.credits_granted == 0) { - /* - * Make sure the client has always at least one credit - */ - credits_granted = 1; } /* -- Samba Shared Repository