Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 33640d71 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag '5.0-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 

Pull smb3 fixes from Steve French:
 "SMB3 fixes, some from this week's SMB3 test evemt, 5 for stable and a
  particularly important one for queryxattr (see xfstests 70 and 117)"

* tag '5.0-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: update internal module version number
  CIFS: fix use-after-free of the lease keys
  CIFS: Do not consider -ENODATA as stat failure for reads
  CIFS: Do not count -ENODATA as failure for query directory
  CIFS: Fix trace command logging for SMB2 reads and writes
  CIFS: Fix possible oops and memory leaks in async IO
  cifs: limit amount of data we request for xattrs to CIFSMaxBufSize
  cifs: fix computation for MAX_SMB2_HDR_SIZE
parents b7bd29b5 b9b9378b

fs/cifs/cifsfs.h

+1 −1
Original line number Diff line number Diff line
@@ -150,5 +150,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg); 
extern const struct export_operations cifs_export_ops;

#endif /* CONFIG_CIFS_NFSD_EXPORT */



#define CIFS_VERSION   "2.16"

#define CIFS_VERSION   "2.17"

#endif				/* _CIFSFS_H */

fs/cifs/file.c

+8 −3
Original line number Diff line number Diff line
@@ -2696,6 +2696,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from, 


			rc = cifs_write_allocate_pages(wdata->pages, nr_pages);

			if (rc) {

				kvfree(wdata->pages);

				kfree(wdata);

				add_credits_and_wake_if(server, credits, 0);

				break;
@@ -2707,6 +2708,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from, 
			if (rc) {

				for (i = 0; i < nr_pages; i++)

					put_page(wdata->pages[i]);

				kvfree(wdata->pages);

				kfree(wdata);

				add_credits_and_wake_if(server, credits, 0);

				break;
@@ -3386,8 +3388,12 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file, 
			}



			rc = cifs_read_allocate_pages(rdata, npages);

			if (rc)

				goto error;

			if (rc) {

				kvfree(rdata->pages);

				kfree(rdata);

				add_credits_and_wake_if(server, credits, 0);

				break;

			}



			rdata->tailsz = PAGE_SIZE;

		}
@@ -3407,7 +3413,6 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file, 
		if (!rdata->cfile->invalidHandle ||

		    !(rc = cifs_reopen_file(rdata->cfile, true)))

			rc = server->ops->async_readv(rdata);

error:

		if (rc) {

			add_credits_and_wake_if(server, rdata->credits, 0);

			kref_put(&rdata->refcount,

fs/cifs/smb2ops.c

+3 −1
Original line number Diff line number Diff line
@@ -866,7 +866,9 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon, 
				      FILE_READ_EA,

				      FILE_FULL_EA_INFORMATION,

				      SMB2_O_INFO_FILE,

				      SMB2_MAX_EA_BUF,

				      CIFSMaxBufSize -

				      MAX_SMB2_CREATE_RESPONSE_SIZE -

				      MAX_SMB2_CLOSE_RESPONSE_SIZE,

				      &rsp_iov, &buftype, cifs_sb);

	if (rc) {

		/*

fs/cifs/smb2pdu.c

+34 −20
Original line number Diff line number Diff line
@@ -3241,8 +3241,17 @@ smb2_readv_callback(struct mid_q_entry *mid) 
		rdata->mr = NULL;

	}

#endif

	if (rdata->result)

	if (rdata->result && rdata->result != -ENODATA) {

		cifs_stats_fail_inc(tcon, SMB2_READ_HE);

		trace_smb3_read_err(0 /* xid */,

				    rdata->cfile->fid.persistent_fid,

				    tcon->tid, tcon->ses->Suid, rdata->offset,

				    rdata->bytes, rdata->result);

	} else

		trace_smb3_read_done(0 /* xid */,

				     rdata->cfile->fid.persistent_fid,

				     tcon->tid, tcon->ses->Suid,

				     rdata->offset, rdata->got_bytes);



	queue_work(cifsiod_wq, &rdata->work);

	DeleteMidQEntry(mid);
@@ -3317,13 +3326,11 @@ smb2_async_readv(struct cifs_readdata *rdata) 
	if (rc) {

		kref_put(&rdata->refcount, cifs_readdata_release);

		cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);

		trace_smb3_read_err(rc, 0 /* xid */, io_parms.persistent_fid,

				   io_parms.tcon->tid, io_parms.tcon->ses->Suid,

				   io_parms.offset, io_parms.length);

	} else

		trace_smb3_read_done(0 /* xid */, io_parms.persistent_fid,

				   io_parms.tcon->tid, io_parms.tcon->ses->Suid,

				   io_parms.offset, io_parms.length);

		trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid,

				    io_parms.tcon->tid,

				    io_parms.tcon->ses->Suid,

				    io_parms.offset, io_parms.length, rc);

	}



	cifs_small_buf_release(buf);

	return rc;
@@ -3367,10 +3374,11 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 
		if (rc != -ENODATA) {

			cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);

			cifs_dbg(VFS, "Send error in read = %d\n", rc);

		}

		trace_smb3_read_err(rc, xid, req->PersistentFileId,

			trace_smb3_read_err(xid, req->PersistentFileId,

					    io_parms->tcon->tid, ses->Suid,

				    io_parms->offset, io_parms->length);

					    io_parms->offset, io_parms->length,

					    rc);

		}

		free_rsp_buf(resp_buftype, rsp_iov.iov_base);

		return rc == -ENODATA ? 0 : rc;

	} else
@@ -3459,8 +3467,17 @@ smb2_writev_callback(struct mid_q_entry *mid) 
		wdata->mr = NULL;

	}

#endif

	if (wdata->result)

	if (wdata->result) {

		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);

		trace_smb3_write_err(0 /* no xid */,

				     wdata->cfile->fid.persistent_fid,

				     tcon->tid, tcon->ses->Suid, wdata->offset,

				     wdata->bytes, wdata->result);

	} else

		trace_smb3_write_done(0 /* no xid */,

				      wdata->cfile->fid.persistent_fid,

				      tcon->tid, tcon->ses->Suid,

				      wdata->offset, wdata->bytes);



	queue_work(cifsiod_wq, &wdata->work);

	DeleteMidQEntry(mid);
@@ -3602,10 +3619,7 @@ smb2_async_writev(struct cifs_writedata *wdata, 
				     wdata->bytes, rc);

		kref_put(&wdata->refcount, release);

		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);

	} else

		trace_smb3_write_done(0 /* no xid */, req->PersistentFileId,

				     tcon->tid, tcon->ses->Suid, wdata->offset,

				     wdata->bytes);

	}



async_writev_out:

	cifs_small_buf_release(req);
@@ -3831,7 +3845,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 
		    rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {

			srch_inf->endOfSearch = true;

			rc = 0;

		}

		} else

			cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);

		goto qdir_exit;

	}
@@ -4427,8 +4441,8 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 
	rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);

	cifs_small_buf_release(req);



	please_key_low = (__u64 *)req->LeaseKey;

	please_key_high = (__u64 *)(req->LeaseKey+8);

	please_key_low = (__u64 *)lease_key;

	please_key_high = (__u64 *)(lease_key+8);

	if (rc) {

		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);

		trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,

fs/cifs/smb2pdu.h

+15 −4
Original line number Diff line number Diff line
@@ -84,8 +84,9 @@ 


#define NUMBER_OF_SMB2_COMMANDS	0x0013



/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */

#define MAX_SMB2_HDR_SIZE 0x00b0

/* 52 transform hdr + 64 hdr + 88 create rsp */

#define SMB2_TRANSFORM_HEADER_SIZE 52

#define MAX_SMB2_HDR_SIZE 204



#define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)

#define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
@@ -648,6 +649,13 @@ struct smb2_create_req { 
	__u8   Buffer[0];

} __packed;



/*

 * Maximum size of a SMB2_CREATE response is 64 (smb2 header) +

 * 88 (fixed part of create response) + 520 (path) + 150 (contexts) +

 * 2 bytes of padding.

 */

#define MAX_SMB2_CREATE_RESPONSE_SIZE 824



struct smb2_create_rsp {

	struct smb2_sync_hdr sync_hdr;

	__le16 StructureSize;	/* Must be 89 */
@@ -996,6 +1004,11 @@ struct smb2_close_req { 
	__u64  VolatileFileId; /* opaque endianness */

} __packed;



/*

 * Maximum size of a SMB2_CLOSE response is 64 (smb2 header) + 60 (data)

 */

#define MAX_SMB2_CLOSE_RESPONSE_SIZE 124



struct smb2_close_rsp {

	struct smb2_sync_hdr sync_hdr;

	__le16 StructureSize; /* 60 */
@@ -1398,8 +1411,6 @@ struct smb2_file_link_info { /* encoding of request for level 11 */ 
	char   FileName[0];     /* Name to be assigned to new link */

} __packed; /* level 11 Set */



#define SMB2_MAX_EA_BUF 65536



struct smb2_file_full_ea_info { /* encoding of response for level 15 */

	__le32 next_entry_offset;

	__u8   flags;