linux-stable.git/fs, branch v4.4.16

ovl: verify upper dentry before unlink and rename

2016-07-27T16:47:40+00:00

commit 11f3710417d026ea2f4fcf362d866342c5274185 upstream.

Unlink and rename in overlayfs checked the upper dentry for staleness by
verifying upper->d_parent against upperdir.  However the dentry can go
stale also by being unhashed, for example.

Expand the verification to actually look up the name again (under parent
lock) and check if it matches the upper dentry.  This matches what the VFS
does before passing the dentry to filesytem's unlink/rename methods, which
excludes any inconsistency caused by overlayfs.

Signed-off-by: Miklos Szeredi 
Signed-off-by: Greg Kroah-Hartman

File names with trailing period or space need special case conversion

2016-07-27T16:47:39+00:00

commit 45e8a2583d97ca758a55c608f78c4cef562644d1 upstream.

POSIX allows files with trailing spaces or a trailing period but
SMB3 does not, so convert these using the normal Services For Mac
mapping as we do for other reserved characters such as
	: < > | ? *
This is similar to what Macs do for the same problem over SMB3.

Signed-off-by: Steve French 
Acked-by: Pavel Shilovsky 
Signed-off-by: Greg Kroah-Hartman

cifs: dynamic allocation of ntlmssp blob

2016-07-27T16:47:39+00:00

commit b8da344b74c822e966c6d19d6b2321efe82c5d97 upstream.

In sess_auth_rawntlmssp_authenticate(), the ntlmssp blob is allocated
statically and its size is an "empirical" 5*sizeof(struct
_AUTHENTICATE_MESSAGE) (320B on x86_64). I don't know where this value
comes from or if it was ever appropriate, but it is currently
insufficient: the user and domain name in UTF16 could take 1kB by
themselves. Because of that, build_ntlmssp_auth_blob() might corrupt
memory (out-of-bounds write). The size of ntlmssp_blob in
SMB2_sess_setup() is too small too (sizeof(struct _NEGOTIATE_MESSAGE)
+ 500).

This patch allocates the blob dynamically in
build_ntlmssp_auth_blob().

Signed-off-by: Jerome Marchand 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

Fix reconnect to not defer smb3 session reconnect long after socket reconnect

2016-07-27T16:47:39+00:00

commit 4fcd1813e6404dd4420c7d12fb483f9320f0bf93 upstream.

Azure server blocks clients that open a socket and don't do anything on it.
In our reconnect scenarios, we can reconnect the tcp session and
detect the socket is available but we defer the negprot and SMB3 session
setup and tree connect reconnection until the next i/o is requested, but
this looks suspicous to some servers who expect SMB3 negprog and session
setup soon after a socket is created.

In the echo thread, reconnect SMB3 sessions and tree connections
that are disconnected.  A later patch will replay persistent (and
resilient) handle opens.

Signed-off-by: Steve French 
Acked-by: Pavel Shilovsky 
Signed-off-by: Greg Kroah-Hartman

ovl: verify upper dentry in ovl_remove_and_whiteout()

2016-07-27T16:47:39+00:00

commit cfc9fde0b07c3b44b570057c5f93dda59dca1c94 upstream.

The upper dentry may become stale before we call ovl_lock_rename_workdir.
For example, someone could (mistakenly or maliciously) manually unlink(2)
it directly from upperdir.

To ensure it is not stale, let's lookup it after ovl_lock_rename_workdir
and and check if it matches the upper dentry.

Essentially, it is the same problem and similar solution as in
commit 11f3710417d0 ("ovl: verify upper dentry before unlink and rename").

Signed-off-by: Maxim Patlasov 
Signed-off-by: Miklos Szeredi 
Signed-off-by: Greg Kroah-Hartman

ovl: Copy up underlying inode's ->i_mode to overlay inode

2016-07-27T16:47:39+00:00

commit 07a2daab49c549a37b5b744cbebb6e3f445f12bc upstream.

Right now when a new overlay inode is created, we initialize overlay
inode's ->i_mode from underlying inode ->i_mode but we retain only
file type bits (S_IFMT) and discard permission bits.

This patch changes it and retains permission bits too. This should allow
overlay to do permission checks on overlay inode itself in task context.

[SzM] It also fixes clearing suid/sgid bits on write.

Signed-off-by: Vivek Goyal 
Reported-by: Eryu Guan 
Signed-off-by: Miklos Szeredi 
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Greg Kroah-Hartman

btrfs: account for non-CoW'd blocks in btrfs_abort_transaction

2016-07-27T16:47:33+00:00

commit 64c12921e11b3a0c10d088606e328c58e29274d8 upstream.

The test for !trans->blocks_used in btrfs_abort_transaction is
insufficient to determine whether it's safe to drop the transaction
handle on the floor.  btrfs_cow_block, informed by should_cow_block,
can return blocks that have already been CoW'd in the current
transaction.  trans->blocks_used is only incremented for new block
allocations. If an operation overlaps the blocks in the current
transaction entirely and must abort the transaction, we'll happily
let it clean up the trans handle even though it may have modified
the blocks and will commit an incomplete operation.

In the long-term, I'd like to do closer tracking of when the fs
is actually modified so we can still recover as gracefully as possible,
but that approach will need some discussion.  In the short term,
since this is the only code using trans->blocks_used, let's just
switch it to a bool indicating whether any blocks were used and set
it when should_cow_block returns false.

Signed-off-by: Jeff Mahoney 
Reviewed-by: Filipe Manana 
Signed-off-by: David Sterba 
Signed-off-by: Greg Kroah-Hartman

UBIFS: Implement ->migratepage()

2016-07-27T16:47:31+00:00

commit 4ac1c17b2044a1b4b2fbed74451947e905fc2992 upstream.

During page migrations UBIFS might get confused
and the following assert triggers:
[  213.480000] UBIFS assert failed in ubifs_set_page_dirty at 1451 (pid 436)
[  213.490000] CPU: 0 PID: 436 Comm: drm-stress-test Not tainted 4.4.4-00176-geaa802524636-dirty #1008
[  213.490000] Hardware name: Allwinner sun4i/sun5i Families
[  213.490000] [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[  213.490000] [] (show_stack) from [] (dump_stack+0x8c/0xa0)
[  213.490000] [] (dump_stack) from [] (ubifs_set_page_dirty+0x44/0x50)
[  213.490000] [] (ubifs_set_page_dirty) from [] (try_to_unmap_one+0x10c/0x3a8)
[  213.490000] [] (try_to_unmap_one) from [] (rmap_walk+0xb4/0x290)
[  213.490000] [] (rmap_walk) from [] (try_to_unmap+0x64/0x80)
[  213.490000] [] (try_to_unmap) from [] (migrate_pages+0x328/0x7a0)
[  213.490000] [] (migrate_pages) from [] (alloc_contig_range+0x168/0x2f4)
[  213.490000] [] (alloc_contig_range) from [] (cma_alloc+0x170/0x2c0)
[  213.490000] [] (cma_alloc) from [] (__alloc_from_contiguous+0x38/0xd8)
[  213.490000] [] (__alloc_from_contiguous) from [] (__dma_alloc+0x23c/0x274)
[  213.490000] [] (__dma_alloc) from [] (arm_dma_alloc+0x54/0x5c)
[  213.490000] [] (arm_dma_alloc) from [] (drm_gem_cma_create+0xb8/0xf0)
[  213.490000] [] (drm_gem_cma_create) from [] (drm_gem_cma_create_with_handle+0x1c/0xe8)
[  213.490000] [] (drm_gem_cma_create_with_handle) from [] (drm_gem_cma_dumb_create+0x3c/0x48)
[  213.490000] [] (drm_gem_cma_dumb_create) from [] (drm_ioctl+0x12c/0x444)
[  213.490000] [] (drm_ioctl) from [] (do_vfs_ioctl+0x3f4/0x614)
[  213.490000] [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c)
[  213.490000] [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x34)

UBIFS is using PagePrivate() which can have different meanings across
filesystems. Therefore the generic page migration code cannot handle this
case correctly.
We have to implement our own migration function which basically does a
plain copy but also duplicates the page private flag.
UBIFS is not a block device filesystem and cannot use buffer_migrate_page().

Signed-off-by: Kirill A. Shutemov 
[rw: Massaged changelog, build fixes, etc...]
Signed-off-by: Richard Weinberger 
Acked-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

NFS: Fix another OPEN_DOWNGRADE bug

2016-07-27T16:47:30+00:00

commit e547f2628327fec6afd2e03b46f113f614cca05b upstream.

Olga Kornievskaia reports that the following test fails to trigger
an OPEN_DOWNGRADE on the wire, and only triggers the final CLOSE.

	fd0 = open(foo, RDRW)   -- should be open on the wire for "both"
	fd1 = open(foo, RDONLY)  -- should be open on the wire for "read"
	close(fd0) -- should trigger an open_downgrade
	read(fd1)
	close(fd1)

The issue is that we're missing a check for whether or not the current
state transitioned from an O_RDWR state as opposed to having transitioned
from a combination of O_RDONLY and O_WRONLY.

Reported-by: Olga Kornievskaia 
Fixes: cd9288ffaea4 ("NFSv4: Fix another bug in the close/open_downgrade code")
Signed-off-by: Trond Myklebust 
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman

make nfs_atomic_open() call d_drop() on all ->open_context() errors.

2016-07-27T16:47:30+00:00

commit d20cb71dbf3487f24549ede1a8e2d67579b4632e upstream.

In "NFSv4: Move dentry instantiation into the NFSv4-specific atomic open code"
unconditional d_drop() after the ->open_context() had been removed.  It had
been correct for success cases (there ->open_context() itself had been doing
dcache manipulations), but not for error ones.  Only one of those (ENOENT)
got a compensatory d_drop() added in that commit, but in fact it should've
been done for all errors.  As it is, the case of O_CREAT non-exclusive open
on a hashed negative dentry racing with e.g. symlink creation from another
client ended up with ->open_context() getting an error and proceeding to
call nfs_lookup().  On a hashed dentry, which would've instantly triggered
BUG_ON() in d_materialise_unique() (or, these days, its equivalent in
d_splice_alias()).

Tested-by: Oleg Drokin 
Signed-off-by: Al Viro 
Signed-off-by: Trond Myklebust 
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman