linux-toradex.git/fs/cifs, branch toradex_vf_4.1

CIFS: Fix a possible memory corruption during reconnect

2017-01-13T01:56:55+00:00

[ Upstream commit 53e0e11efe9289535b060a51d4cf37c25e0d0f2b ]

We can not unlock/lock cifs_tcp_ses_lock while walking through ses
and tcon lists because it can corrupt list iterator pointers and
a tcon structure can be released if we don't hold an extra reference.
Fix it by moving a reconnect process to a separate delayed work
and acquiring a reference to every tcon that needs to be reconnected.
Also do not send an echo request on newly established connections.

CC: Stable 
Signed-off-by: Pavel Shilovsky 
Signed-off-by: Sasha Levin

CIFS: Fix a possible memory corruption in push locks

2017-01-13T01:56:55+00:00

[ Upstream commit e3d240e9d505fc67f8f8735836df97a794bbd946 ]

If maxBuf is not 0 but less than a size of SMB2 lock structure
we can end up with a memory corruption.

Cc: Stable 
Signed-off-by: Pavel Shilovsky 
Signed-off-by: Sasha Levin

CIFS: Fix missing nls unload in smb2_reconnect()

2017-01-13T01:56:55+00:00

[ Upstream commit 4772c79599564bd08ee6682715a7d3516f67433f ]

Cc: Stable 
Acked-by: Sachin Prabhu 
Signed-off-by: Pavel Shilovsky 
Signed-off-by: Sasha Levin

fs: Give dentry to inode_change_ok() instead of inode

2016-12-23T13:56:35+00:00

[ Upstream commit 31051c85b5e2aaaf6315f74c72a732673632a905 ]

inode_change_ok() will be resposible for clearing capabilities and IMA
extended attributes and as such will need dentry. Give it as an argument
to inode_change_ok() instead of an inode. Also rename inode_change_ok()
to setattr_prepare() to better relect that it does also some
modifications in addition to checks.

References: CVE-2015-1350
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
Signed-off-by: Philipp Hahn 
Signed-off-by: Sasha Levin

CIFS: Fix a possible invalid memory access in smb2_query_symlink()

2016-08-20T03:07:58+00:00

[ Upstream commit 7893242e2465aea6f2cbc2639da8fa5ce96e8cc2 ]

During following a symbolic link we received err_buf from SMB2_open().
While the validity of SMB2 error response is checked previously
in smb2_check_message() a symbolic link payload is not checked at all.
Fix it by adding such checks.

Cc: Dan Carpenter 
CC: Stable 
Signed-off-by: Pavel Shilovsky 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

fs/cifs: make share unaccessible at root level mountable

2016-08-20T03:07:58+00:00

[ Upstream commit a6b5058fafdf508904bbf16c29b24042cef3c496 ]

if, when mounting //HOST/share/sub/dir/foo we can query /sub/dir/foo but
not any of the path components above:

- store the /sub/dir/foo prefix in the cifs super_block info
- in the superblock, set root dentry to the subpath dentry (instead of
  the share root)
- set a flag in the superblock to remember it
- use prefixpath when building path from a dentry

fixes bso#8950

Signed-off-by: Aurelien Aptel 
CC: Stable 
Reviewed-by: Pavel Shilovsky 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

cifs: fix crash due to race in hmac(md5) handling

2016-08-20T03:07:58+00:00

[ Upstream commit bd975d1eead2558b76e1079e861eacf1f678b73b ]

The secmech hmac(md5) structures are present in the TCP_Server_Info
struct and can be shared among multiple CIFS sessions.  However, the
server mutex is not currently held when these structures are allocated
and used, which can lead to a kernel crashes, as in the scenario below:

mount.cifs(8) #1				mount.cifs(8) #2

Is secmech.sdeschmaccmd5 allocated?
// false

						Is secmech.sdeschmaccmd5 allocated?
						// false

secmech.hmacmd = crypto_alloc_shash..
secmech.sdeschmaccmd5 = kzalloc..
sdeschmaccmd5->shash.tfm = &secmec.hmacmd;

						secmech.sdeschmaccmd5 = kzalloc
						// sdeschmaccmd5->shash.tfm
						// not yet assigned

crypto_shash_update()
 deref NULL sdeschmaccmd5->shash.tfm

 Unable to handle kernel paging request at virtual address 00000030
 epc   : 8027ba34 crypto_shash_update+0x38/0x158
 ra    : 8020f2e8 setup_ntlmv2_rsp+0x4bc/0xa84
 Call Trace:
  crypto_shash_update+0x38/0x158
  setup_ntlmv2_rsp+0x4bc/0xa84
  build_ntlmssp_auth_blob+0xbc/0x34c
  sess_auth_rawntlmssp_authenticate+0xac/0x248
  CIFS_SessSetup+0xf0/0x178
  cifs_setup_session+0x4c/0x84
  cifs_get_smb_ses+0x2c8/0x314
  cifs_mount+0x38c/0x76c
  cifs_do_mount+0x98/0x440
  mount_fs+0x20/0xc0
  vfs_kern_mount+0x58/0x138
  do_mount+0x1e8/0xccc
  SyS_mount+0x88/0xd4
  syscall_common+0x30/0x54

Fix this by locking the srv_mutex around the code which uses these
hmac(md5) structures.  All the other secmech algos already have similar
locking.

Fixes: 95dc8dd14e2e84cc ("Limit allocation of crypto mechanisms to dialect which requires")
Signed-off-by: Rabin Vincent 
Acked-by: Sachin Prabhu 
CC: Stable 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

cifs: Check for existing directory when opening file with O_CREAT

2016-08-17T16:58:31+00:00

[ Upstream commit 8d9535b6efd86e6c07da59f97e68f44efb7fe080 ]

When opening a file with O_CREAT flag, check to see if the file opened
is an existing directory.

This prevents the directory from being opened which subsequently causes
a crash when the close function for directories cifs_closedir() is called
which frees up the file->private_data memory while the file is still
listed on the open file list for the tcon.

Signed-off-by: Sachin Prabhu 
Signed-off-by: Steve French 
CC: Stable 
Reported-by: Xiaoli Feng 
Signed-off-by: Sasha Levin

File names with trailing period or space need special case conversion

2016-07-11T02:27:10+00:00

[ Upstream commit 45e8a2583d97ca758a55c608f78c4cef562644d1 ]

POSIX allows files with trailing spaces or a trailing period but
SMB3 does not, so convert these using the normal Services For Mac
mapping as we do for other reserved characters such as
	: < > | ? *
This is similar to what Macs do for the same problem over SMB3.

CC: Stable 
Signed-off-by: Steve French 
Acked-by: Pavel Shilovsky 
Signed-off-by: Sasha Levin

Fix reconnect to not defer smb3 session reconnect long after socket reconnect

2016-07-11T02:27:10+00:00

[ Upstream commit 4fcd1813e6404dd4420c7d12fb483f9320f0bf93 ]

Azure server blocks clients that open a socket and don't do anything on it.
In our reconnect scenarios, we can reconnect the tcp session and
detect the socket is available but we defer the negprot and SMB3 session
setup and tree connect reconnection until the next i/o is requested, but
this looks suspicous to some servers who expect SMB3 negprog and session
setup soon after a socket is created.

In the echo thread, reconnect SMB3 sessions and tree connections
that are disconnected.  A later patch will replay persistent (and
resilient) handle opens.

CC: Stable 
Signed-off-by: Steve French 
Acked-by: Pavel Shilovsky 
Signed-off-by: Sasha Levin