linux-toradex.git/fs/smb/server/mgmt, branch v6.9

ksmbd: validate payload size in ipc response

2024-04-02T14:21:01+00:00

If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc
response to ksmbd kernel server. ksmbd should validate payload size of
ipc response from ksmbd.mountd to avoid memory overrun or
slab-out-of-bounds. This patch validate 3 ipc response that has payload.

Cc: stable@vger.kernel.org
Reported-by: Chao Ma 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: add support for durable handles v1/v2

2024-03-12T05:36:39+00:00

Durable file handles allow reopening a file preserved on a short
network outage and transparent client reconnection within a timeout.
i.e. Durable handles aren't necessarily cleaned up when the opening
process terminates.

This patch add support for durable handle version 1 and 2.

To prove durable handles work on ksmbd, I have tested this patch with
the following smbtorture tests:

smb2.durable-open.open-oplock
smb2.durable-open.open-lease
smb2.durable-open.reopen1
smb2.durable-open.reopen1a
smb2.durable-open.reopen1a-lease
smb2.durable-open.reopen2
smb2.durable-open.reopen2a
smb2.durable-open.reopen2-lease
smb2.durable-open.reopen2-lease-v2
smb2.durable-open.reopen3
smb2.durable-open.reopen4
smb2.durable-open.delete_on_close2
smb2.durable-open.file-position
smb2.durable-open.lease
smb2.durable-open.alloc-size
smb2.durable-open.read-only
smb2.durable-v2-open.create-blob
smb2.durable-v2-open.open-oplock
smb2.durable-v2-open.open-lease
smb2.durable-v2-open.reopen1
smb2.durable-v2-open.reopen1a
smb2.durable-v2-open.reopen1a-lease
smb2.durable-v2-open.reopen2
smb2.durable-v2-open.reopen2b

Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: mark SMB2_SESSION_EXPIRED to session when destroying previous session

2024-03-12T05:36:39+00:00

Currently ksmbd exit connection as well destroying previous session.
When testing durable handle feaure, I found that
destroy_previous_session() should destroy only session, i.e. the
connection should be still alive. This patch mark SMB2_SESSION_EXPIRED
on the previous session to be destroyed later and not used anymore.

Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: Remove usage of the deprecated ida_simple_xx() API

2024-01-09T18:52:33+00:00

ida_alloc() and ida_free() should be preferred to the deprecated
ida_simple_get() and ida_simple_remove().

This is less verbose.

Note that the upper limit of ida_simple_get() is exclusive, but the one of
ida_alloc_range() is inclusive. So change a 0xFFFFFFFF into a 0xFFFFFFFE in
order to keep the same behavior.

Signed-off-by: Christophe JAILLET 
Acked-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: Remove unused field in ksmbd_user struct

2023-10-23T00:06:27+00:00

fs/smb/server/mgmt/user_config.h:21: Remove the unused field 'failed_login_count' from the ksmbd_user struct.

Signed-off-by: Cheng-Han Wu 
Acked-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix race condition between tree conn lookup and disconnect

2023-10-05T02:56:28+00:00

if thread A in smb2_write is using work-tcon, other thread B use
smb2_tree_disconnect free the tcon, then thread A will use free'd tcon.

                            Time
                             +
 Thread A                    | Thread A
 smb2_write                  | smb2_tree_disconnect
                             |
                             |
                             |   kfree(tree_conn)
                             |
  // UAF!                    |
  work->tcon->share_conf     |
                             +

This patch add state, reference count and lock for tree conn to fix race
condition issue.

Reported-by: luosili 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix race condition between session lookup and expire

2023-10-05T01:21:48+00:00

 Thread A                        +  Thread B
 ksmbd_session_lookup            |  smb2_sess_setup
   sess = xa_load                |
                                 |
                                 |    xa_erase(&conn->sessions, sess->id);
                                 |
                                 |    ksmbd_session_destroy(sess) --> kfree(sess)
                                 |
   // UAF!                       |
   sess->last_active = jiffies   |
                                 +

This patch add rwsem to fix race condition between ksmbd_session_lookup
and ksmbd_expire_session.

Reported-by: luosili 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix `force create mode' and `force directory mode'

2023-08-29T17:30:20+00:00

`force create mode' and `force directory mode' should be bitwise ORed
with the perms after `create mask' and `directory mask' have been
applied, respectively.

Signed-off-by: Atte Heikkilä 
Acked-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: remove unused ksmbd_tree_conn_share function

2023-06-26T05:07:04+00:00

Remove unused ksmbd_tree_conn_share function.

Signed-off-by: Namjae Jeon 
Reviewed-by: Sergey Senozhatsky 
Signed-off-by: Steve French

smb: move client and server files to common directory fs/smb

2023-05-24T21:29:21+00:00

Move CIFS/SMB3 related client and server files (cifs.ko and ksmbd.ko
and helper modules) to new fs/smb subdirectory:

   fs/cifs --> fs/smb/client
   fs/ksmbd --> fs/smb/server
   fs/smbfs_common --> fs/smb/common

Suggested-by: Linus Torvalds 
Acked-by: Namjae Jeon 
Signed-off-by: Steve French