samba - Sep 2022 - connection shutdown tevent_req is not freed

Hi,

The function smbd_server_connection_terminate_done does not free subreq
which is allocated in smbXsrv_connection_shutdown_send, this can be a
memory leakage if multi-channel is enabled.
Following is possible fix,
Thanks
Haihua

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index e8a91238baf..1cd5953f116 100644
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -1643,6 +1643,7 @@ static void
smbd_server_connection_terminate_done(struct tevent_req *subreq)
        NTSTATUS status;

        status = smbXsrv_connection_shutdown_recv(subreq);
+       TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
                exit_server("smbXsrv_connection_shutdown_recv
failed");
        }

On Sun, Sep 04, 2022 at 09:29:52PM -0700, haihua yang via samba
wrote:
>Hi,
>
>The function smbd_server_connection_terminate_done does not free subreq
>which is allocated in smbXsrv_connection_shutdown_send, this can be a
>memory leakage if multi-channel is enabled.
>Following is possible fix,
>Thanks
>Haihua
>
>diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
>index e8a91238baf..1cd5953f116 100644
>--- a/source3/smbd/smb2_server.c
>+++ b/source3/smbd/smb2_server.c
>@@ -1643,6 +1643,7 @@ static void
>smbd_server_connection_terminate_done(struct tevent_req *subreq)
>        NTSTATUS status;
>
>        status = smbXsrv_connection_shutdown_recv(subreq);
>+       TALLOC_FREE(subreq);
>        if (!NT_STATUS_IS_OK(status)) {
>                exit_server("smbXsrv_connection_shutdown_recv
failed");
>        }
Hi Hihua,

This looks correct. Metze created a bug report:

https://bugzilla.samba.org/show_bug.cgi?id=15174

and I'm pushing an MR to gitlab. If you plan to
contribute more to Samba can you send in the
Samba Developer's Declaration, as described here:

https://www.samba.org/samba/devel/copyright-policy.html

Thanks !

Jeremy.