linux-stable.git/fs/cifs, branch linux-3.6.y

cifs: Do not lookup hashed negative dentry in cifs_atomic_open

2012-11-26T20:14:07+00:00

commit 3798f47aa276b332c30da499cb4df4577e2f8872 upstream.

We do not need to lookup a hashed negative directory since we have
already revalidated it before and have found it to be fine.

This also prevents a crash in cifs_lookup() when it attempts to rehash
the already hashed negative lookup dentry.

The patch has been tested using the reproducer at
https://bugzilla.redhat.com/show_bug.cgi?id=867344#c28

Reported-by: Vit Zahradka 
Signed-off-by: Sachin Prabhu 
Signed-off-by: Greg Kroah-Hartman

cifs: fix potential buffer overrun in cifs.idmap handling code

2012-11-26T20:14:06+00:00

commit 36960e440ccf94349c09fb944930d3bfe4bc473f upstream.

The userspace cifs.idmap program generally works with the wbclient libs
to generate binary SIDs in userspace. That program defines the struct
that holds these values as having a max of 15 subauthorities. The kernel
idmapping code however limits that value to 5.

When the kernel copies those values around though, it doesn't sanity
check the num_subauths value handed back from userspace or from the
server. It's possible therefore for userspace to hand us back a bogus
num_subauths value (or one that's valid, but greater than 5) that could
cause the kernel to walk off the end of the cifs_sid->sub_auths array.

Fix this by defining a new routine for copying sids and using that in
all of the places that copy it. If we end up with a sid that's longer
than expected then this approach will just lop off the "extra" subauths,
but that's basically what the code does today already. Better approaches
might be to fix this code to reject SIDs with >5 subauths, or fix it
to handle the subauths array dynamically.

At the same time, change the kernel to check the length of the data
returned by userspace. If it's shorter than struct cifs_sid, reject it
and return -EIO. If that happens we'll end up with fields that are
basically uninitialized.

Long term, it might make sense to redefine cifs_sid using a flexarray at
the end, to allow for variable-length subauth lists, and teach the code
to handle the case where the subauths array being passed in from
userspace is shorter than 5 elements.

Note too, that I don't consider this a security issue since you'd need
a compromised cifs.idmap program. If you have that, you can do all sorts
of nefarious stuff. Still, this is probably reasonable for stable.

Reviewed-by: Shirish Pargaonkar 
Signed-off-by: Jeff Layton 
Signed-off-by: Greg Kroah-Hartman

Convert properly UTF-8 to UTF-16

2012-10-12T20:50:35+00:00

commit fd3ba42c76d3d4b776120c2b24c1791e7bb3deb1 upstream.

wchar_t is currently 16bit so converting a utf8 encoded characters not
in plane 0 (>= 0x10000) to wchar_t (that is calling char2uni) lead to a
-EINVAL return. This patch detect utf8 in cifs_strtoUTF16 and add special
code calling utf8s_to_utf16s.

Signed-off-by: Frediano Ziglio 
Acked-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: reinstate the forcegid option

2012-10-12T20:50:35+00:00

commit 72bd481f860f0125c810bb43d878ce5f9c060c58 upstream.

Apparently this was lost when we converted to the standard option
parser in 8830d7e07a5e38bc47650a7554b7c1cfd49902bf

Reported-by: Gregory Lee Bartholomew 
Cc: Sachin Prabhu 
Signed-off-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: fix return value in cifsConvertToUTF16

2012-09-18T20:35:25+00:00

This function returns the wrong value, which causes the callers to get
the length of the resulting pathname wrong when it contains non-ASCII
characters.

This seems to fix https://bugzilla.samba.org/show_bug.cgi?id=6767

Cc: 
Reported-by: Baldvin Kovacs 
Reported-and-Tested-by: Nicolas Lefebvre 
Signed-off-by: Jeff Layton 
Signed-off-by: Steve French

CIFS: Fix endianness conversion

2012-09-06T17:42:35+00:00

Signed-off-by: Pavel Shilovsky 
Signed-off-by: Steve French

CIFS: Fix error handling in cifs_push_mandatory_locks

2012-09-06T17:42:31+00:00

Cc: 
Signed-off-by: Pavel Shilovsky 
Signed-off-by: Steve French

CIFS: Fix cifs_do_create error hadnling

2012-08-20T03:30:18+00:00

Commit d2c127197dfc0b2bae62a52e1e0d3e3ff493919e caused a regression
in cifs_do_create error handling. Fix this by closing a file handle
in the case of a get_inode_info(_unix) error. Also remove unnecessary
checks for newinode being NULL.

Signed-off-by: Pavel Shilovsky 
Signed-off-by: Steve French

cifs: print error code if smb signature verification fails

2012-08-20T03:30:13+00:00

While trying to debug a SMB signature related issue with Windows Servers
figured out it might be easier to debug if we print the error code from
cifs_verify_signature(). Also, fix indendation while at it.

Signed-off-by: Suresh Jayaraman 
Reviewed-by: Jeff Layton 
Signed-off-by: Steve French

CIFS: Fix log messages in packet checking for SMB2

2012-08-20T03:30:07+00:00

Signed-off-by: Pavel Shilovsky 
Signed-off-by: Steve French