linux-stable.git/fs, branch v3.18.35

cifs: Create dedicated keyring for spnego operations

2016-06-06T23:11:09+00:00

[ Upstream commit b74cb9a80268be5c80cf4c87c74debf0ff2129ac ]

The session key is the default keyring set for request_key operations.
This session key is revoked when the user owning the session logs out.
Any long running daemon processes started by this session ends up with
revoked session keyring which prevents these processes from using the
request_key mechanism from obtaining the krb5 keys.

The problem has been reported by a large number of autofs users. The
problem is also seen with multiuser mounts where the share may be used
by processes run by a user who has since logged out. A reproducer using
automount is available on the Red Hat bz.

The patch creates a new keyring which is used to cache cifs spnego
upcalls.

Red Hat bz: 1267754

Signed-off-by: Sachin Prabhu 
Reported-by: Scott Mayhew 
Reviewed-by: Shirish Pargaonkar 
CC: Stable 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

xfs: skip stale inodes in xfs_iflush_cluster

2016-06-06T23:11:08+00:00

[ Upstream commit 7d3aa7fe970791f1a674b14572a411accf2f4d4e ]

We don't write back stale inodes so we should skip them in
xfs_iflush_cluster, too.

cc:  # 3.10.x-
Signed-off-by: Dave Chinner 
Reviewed-by: Brian Foster 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Dave Chinner 
Signed-off-by: Sasha Levin

xfs: fix inode validity check in xfs_iflush_cluster

2016-06-06T23:11:08+00:00

[ Upstream commit 51b07f30a71c27405259a0248206ed4e22adbee2 ]

Some careless idiot(*) wrote crap code in commit 1a3e8f3 ("xfs:
convert inode cache lookups to use RCU locking") back in late 2010,
and so xfs_iflush_cluster checks the wrong inode for whether it is
still valid under RCU protection. Fix it to lock and check the
correct inode.

(*) Careless-idiot: Dave Chinner 

cc:  # 3.10.x-
Discovered-by: Brain Foster 
Signed-off-by: Dave Chinner 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Dave Chinner 
Signed-off-by: Sasha Levin

xfs: xfs_iflush_cluster fails to abort on error

2016-06-06T23:11:08+00:00

[ Upstream commit b1438f477934f5a4d5a44df26f3079a7575d5946 ]

When a failure due to an inode buffer occurs, the error handling
fails to abort the inode writeback correctly. This can result in the
inode being reclaimed whilst still in the AIL, leading to
use-after-free situations as well as filesystems that cannot be
unmounted as the inode log items left in the AIL never get removed.

Fix this by ensuring fatal errors from xfs_imap_to_bp() result in
the inode flush being aborted correctly.

cc:  # 3.10.x-
Reported-by: Shyam Kaushik 
Diagnosed-by: Shyam Kaushik 
Tested-by: Shyam Kaushik 
Signed-off-by: Dave Chinner 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Dave Chinner 
Signed-off-by: Sasha Levin

remove directory incorrectly tries to set delete on close on non-empty directories

2016-06-06T23:11:07+00:00

[ Upstream commit 897fba1172d637d344f009d700f7eb8a1fa262f1 ]

Wrong return code was being returned on SMB3 rmdir of
non-empty directory.

For SMB3 (unlike for cifs), we attempt to delete a directory by
set of delete on close flag on the open. Windows clients set
this flag via a set info (SET_FILE_DISPOSITION to set this flag)
which properly checks if the directory is empty.

With this patch on smb3 mounts we correctly return
 "DIRECTORY NOT EMPTY"
on attempts to remove a non-empty directory.

Signed-off-by: Steve French 
CC: Stable 
Acked-by: Sachin Prabhu 
Signed-off-by: Sasha Levin

fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication

2016-06-06T23:11:07+00:00

[ Upstream commit 1a967d6c9b39c226be1b45f13acd4d8a5ab3dc44 ]

Only server which map unknown users to guest will allow
access using a non-null NTLMv2_Response.

For Samba it's the "map to guest = bad user" option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11913

Signed-off-by: Stefan Metzmacher 
CC: Stable 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication

2016-06-06T23:11:07+00:00

[ Upstream commit 777f69b8d26bf35ade4a76b08f203c11e048365d ]

Only server which map unknown users to guest will allow
access using a non-null NTChallengeResponse.

For Samba it's the "map to guest = bad user" option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11913

Signed-off-by: Stefan Metzmacher 
CC: Stable 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

fs/cifs: correctly to anonymous authentication for the LANMAN authentication

2016-06-06T23:11:06+00:00

[ Upstream commit fa8f3a354bb775ec586e4475bcb07f7dece97e0c ]

Only server which map unknown users to guest will allow
access using a non-null LMChallengeResponse.

For Samba it's the "map to guest = bad user" option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11913

Signed-off-by: Stefan Metzmacher 
CC: Stable 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

fs/cifs: correctly to anonymous authentication via NTLMSSP

2016-06-06T23:11:06+00:00

[ Upstream commit cfda35d98298131bf38fbad3ce4cd5ecb3cf18db ]

See [MS-NLMP] 3.2.5.1.2 Server Receives an AUTHENTICATE_MESSAGE from the Client:

   ...
   Set NullSession to FALSE
   If (AUTHENTICATE_MESSAGE.UserNameLen == 0 AND
      AUTHENTICATE_MESSAGE.NtChallengeResponse.Length == 0 AND
      (AUTHENTICATE_MESSAGE.LmChallengeResponse == Z(1)
       OR
       AUTHENTICATE_MESSAGE.LmChallengeResponse.Length == 0))
       -- Special case: client requested anonymous authentication
       Set NullSession to TRUE
   ...

Only server which map unknown users to guest will allow
access using a non-null NTChallengeResponse.

For Samba it's the "map to guest = bad user" option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11913

CC: Stable 
Signed-off-by: Stefan Metzmacher 
Signed-off-by: Steve French 
Signed-off-by: Sasha Levin

mm: fix huge zero page accounting in smaps report

2016-06-03T15:30:36+00:00

[ Upstream commit c164e038eee805147e95789dddb88ae3b3aca11c ]

As a small zero page, huge zero page should not be accounted in smaps
report as normal page.

For small pages we rely on vm_normal_page() to filter out zero page, but
vm_normal_page() is not designed to handle pmds.  We only get here due
hackish cast pmd to pte in smaps_pte_range() -- pte and pmd format is not
necessary compatible on each and every architecture.

Let's add separate codepath to handle pmds.  follow_trans_huge_pmd() will
detect huge zero page for us.

We would need pmd_dirty() helper to do this properly.  The patch adds it
to THP-enabled architectures which don't yet have one.

[akpm@linux-foundation.org: use do_div to fix 32-bit build]
Signed-off-by: "Kirill A. Shutemov" 
Reported-by: Fengguang Wu 
Tested-by: Fengwei Yin 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 

Signed-off-by: Sasha Levin