samba.git/source3/param, branch master

s3:loadparm: return NULL upon memalloc failure in lp_idmap_backend

2026-04-23T20:53:10+00:00

Return NULL instead of valid-but-misleading cast from 'false' to
pointer.

Signed-off-by: Shachar Sharon 
Reviewed-by: Noel Power 
Reviewed-by: Anoop C S 

Autobuild-User(master): Anoop C S 
Autobuild-Date(master): Thu Apr 23 20:53:10 UTC 2026 on atb-devel-224

s3:loadparm: fix NULL pointer dereference in volume_label()

2026-04-15T00:07:12+00:00

volume_label() calls lp_servicename() as a fallback when lp_volume()
returns an empty string. lp_servicename() is a FN_LOCAL_SUBSTITUTED_STRING
that falls back to sDefault.szService when the service is invalid. Since
sDefault.szService is initialized to NULL and is never set by
init_globals(), the substitution returns NULL, and the subsequent
strlen() call crashes with a segmentation fault.

Add a NULL guard so volume_label() returns an empty string instead
of crashing.

Remove knownfail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14978

Co-Authored-By: Claude Opus 4.6 (1M context) 

Signed-off-by: Jeremy Allison 
Reviewed-by: David Mulder 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Wed Apr 15 00:07:12 UTC 2026 on atb-devel-224

s3:loadparm: guard free_service_byindex() in lp_servicenumber() with snum_in_use check

2026-04-14T23:04:37+00:00

lp_servicenumber() calls free_service_byindex() to destroy usershare
services when usershare_exists() returns false or when the usershare
file has been modified. This is unsafe because active connections may
still hold the service number — the destroyed service leaves a NULL
ServicePtrs[] entry that causes a NULL pointer dereference when the
connection subsequently calls lp_servicename() or similar functions.

The crash path is:
  get_referred_path() -> lp_servicenumber() -> usershare_exists()
  fails (e.g. EACCES) -> free_service_byindex() destroys service ->
  later request on same connection -> volume_label() ->
  lp_servicename() -> FN_LOCAL_SUBSTITUTED_STRING falls back to
  sDefault.szService (NULL) -> strlen(NULL) -> SIGSEGV

Guard both free_service_byindex() call sites with the snum_in_use
callback registered in the previous commit. When the service is in
use by an active connection, skip the destruction and let the
periodic load_usershare_shares() mark-and-sweep handle cleanup
safely via its conn_snum_used() check.

When snum_in_use is NULL (non-smbd programs), the original behaviour
is preserved — services are freed immediately since no connections
can exist.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14978

Co-Authored-By: Claude Opus 4.6 (1M context) 

Signed-off-by: Jeremy Allison 
Reviewed-by: David Mulder

s3:loadparm: add lp_register_snum_in_use_fn() callback registration

2026-04-14T23:04:37+00:00

Add a mechanism for smbd to register a callback that checks whether
a service number is currently in use by any active connection.

This will be used by subsequent commits to guard free_service_byindex()
calls in lp_servicenumber() and other sites that currently destroy
services without checking if they are in use, which can leave active
connections holding stale service numbers that lead to NULL pointer
dereferences.

The callback is registered by smbd during smbd_process() startup via
connections_snum_used. Non-smbd programs (testparm, net, etc.) leave the
callback as NULL, meaning no connections exist and it is always safe
to free services.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14978

Co-Authored-By: Claude Opus 4.6 (1M context) 

Signed-off-by: Jeremy Allison 
Reviewed-by: David Mulder

lib: Remove the "getwd cache"

2026-03-01T20:19:35+00:00

No longer needed

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

param: Simplify check_ad_dc_required_mods()

2026-02-15T10:42:34+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

lib: Move a variable declaration closer to its use

2026-01-20T11:53:35+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

loadparm: Simplify canonicalize_servicename()

2026-01-20T11:53:34+00:00

We have strlower_talloc()

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

loadparm: Modernize DEBUGs

2026-01-20T11:53:34+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

loadparm: add "kdc require canonicalization"

2026-01-15T01:48:37+00:00

Has no effect yet.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer