linux-stable.git/fs, branch v3.18.95

kernfs: fix regression in kernfs_fop_write caused by wrong type

2018-02-16T19:14:44+00:00

commit ba87977a49913129962af8ac35b0e13e0fa4382d upstream.

Commit b7ce40cff0b9 ("kernfs: cache atomic_write_len in
kernfs_open_file") changes type of local variable 'len' from ssize_t
to size_t. This change caused that the *ppos value is updated also
when the previous write callback failed.

Mentioned snippet:
...
len = ops->write(...); <- return value can be negative
...
if (len > 0)           <- true here in this case
        *ppos += len;
...

Fixes: b7ce40cff0b9 ("kernfs: cache atomic_write_len in kernfs_open_file")
Acked-by: Tejun Heo 
Signed-off-by: Ivan Vecera 
Signed-off-by: Al Viro 
Signed-off-by: Greg Kroah-Hartman

NFS: commit direct writes even if they fail partially

2018-02-16T19:14:44+00:00

commit 1b8d97b0a837beaf48a8449955b52c650a7114b4 upstream.

If some of the WRITE calls making up an O_DIRECT write syscall fail,
we neglect to commit, even if some of the WRITEs succeed.

We also depend on the commit code to free the reference count on the
nfs_page taken in the "if (request_commit)" case at the end of
nfs_direct_write_completion().  The problem was originally noticed
because ENOSPC's encountered partway through a write would result in a
closed file being sillyrenamed when it should have been unlinked.

Signed-off-by: J. Bruce Fields 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

NFS: Add a cond_resched() to nfs_commit_release_pages()

2018-02-16T19:14:44+00:00

commit 7f1bda447c9bd48b415acedba6b830f61591601f upstream.

The commit list can get very large, and so we need a cond_resched()
in nfs_commit_release_pages() in order to ensure we don't hog the CPU
for excessive periods of time.

Reported-by: Mike Galbraith 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

CIFS: zero sensitive data when freeing

2018-02-16T19:14:42+00:00

commit 97f4b7276b829a8927ac903a119bef2f963ccc58 upstream.

also replaces memset()+kfree() by kzfree().

Signed-off-by: Aurelien Aptel 
Signed-off-by: Steve French 
Reviewed-by: Pavel Shilovsky 
Signed-off-by: Greg Kroah-Hartman

cifs: Fix autonegotiate security settings mismatch

2018-02-16T19:14:42+00:00

commit 9aca7e454415f7878b28524e76bebe1170911a88 upstream.

Autonegotiation gives a security settings mismatch error if the SMB
server selects an SMBv3 dialect that isn't SMB3.02. The exact error is
"protocol revalidation - security settings mismatch".
This can be tested using Samba v4.2 or by setting the global Samba
setting max protocol = SMB3_00.

The check that fails in smb3_validate_negotiate is the dialect
verification of the negotiate info response. This is because it tries
to verify against the protocol_id in the global smbdefault_values. The
protocol_id in smbdefault_values is SMB3.02.
In SMB2_negotiate the protocol_id in smbdefault_values isn't updated,
it is global so it probably shouldn't be, but server->dialect is.

This patch changes the check in smb3_validate_negotiate to use
server->dialect instead of server->vals->protocol_id. The patch works
with autonegotiate and when using a specific version in the vers mount
option.

Signed-off-by: Daniel N Pettersson 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: Fix missing put_xid in cifs_file_strict_mmap

2018-02-16T19:14:42+00:00

commit f04a703c3d613845ae3141bfaf223489de8ab3eb upstream.

If cifs_zap_mapping() returned an error, we would return without putting
the xid that we got earlier.  Restructure cifs_file_strict_mmap() and
cifs_file_mmap() to be more similar to each other and have a single
point of return that always puts the xid.

Signed-off-by: Matthew Wilcox 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

quota: Check for register_shrinker() failure.

2018-02-07T19:07:56+00:00

[ Upstream commit 88bc0ede8d35edc969350852894dc864a2dc1859 ]

register_shrinker() might return -ENOMEM error since Linux 3.12.
Call panic() as with other failure checks in this function if
register_shrinker() failed.

Fixes: 1d3d4437eae1 ("vmscan: per-node deferred work")
Signed-off-by: Tetsuo Handa 
Cc: Jan Kara 
Cc: Michal Hocko 
Reviewed-by: Michal Hocko 
Signed-off-by: Jan Kara 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

nfsd: check for use of the closed special stateid

2018-02-07T19:07:55+00:00

[ Upstream commit ae254dac721d44c0bfebe2795df87459e2e88219 ]

Prevent the use of the closed (invalid) special stateid by clients.

Signed-off-by: Andrew Elble 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0)

2018-02-07T19:07:55+00:00

[ Upstream commit fb500a7cfee7f2f447d2bbf30cb59629feab6ac1 ]

Signed-off-by: Trond Myklebust 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

fs/fcntl: f_setown, avoid undefined behaviour

2018-01-31T13:46:14+00:00

commit fc3dc67471461c0efcb1ed22fb7595121d65fad9 upstream.

fcntl(0, F_SETOWN, 0x80000000) triggers:
UBSAN: Undefined behaviour in fs/fcntl.c:118:7
negation of -2147483648 cannot be represented in type 'int':
CPU: 1 PID: 18261 Comm: syz-executor Not tainted 4.8.1-0-syzkaller #1
...
Call Trace:
...
 [] ? f_setown+0x1d8/0x200
 [] ? SyS_fcntl+0x999/0xf30
 [] ? entry_SYSCALL_64_fastpath+0x23/0xc1

Fix that by checking the arg parameter properly (against INT_MAX) before
"who = -who". And return immediatelly with -EINVAL in case it is wrong.
Note that according to POSIX we can return EINVAL:
    http://pubs.opengroup.org/onlinepubs/9699919799/functions/fcntl.html

    [EINVAL]
        The cmd argument is F_SETOWN and the value of the argument
        is not valid as a process or process group identifier.

[v2] returns an error, v1 used to fail silently
[v3] implement proper check for the bad value INT_MIN

Signed-off-by: Jiri Slaby 
Cc: Jeff Layton 
Cc: "J. Bruce Fields" 
Cc: Alexander Viro 
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Jeff Layton 
Signed-off-by: Greg Kroah-Hartman