linux.git/fs/cifs, branch v4.0

Fix warning

2015-04-01T05:01:47+00:00

Coverity reports a warning due to unitialized attr structure in one
code path.

Reported by Coverity (CID 728535)

Signed-off-by: Steve French 
Reviewed-by: Jeff Layton

Fix another dereference before null check warning

2015-04-01T05:01:47+00:00

null tcon is not possible in these paths so
remove confusing null check

Reported by Coverity (CID 728519)

Signed-off-by: Steve French 
Reviewed-by: Jeff Layton

CIFS: session servername can't be null

2015-04-01T05:01:47+00:00

remove impossible check

Pointed out by Coverity (CID 115422)

Signed-off-by: Steve French 
Reviewed-by: Jeff Layton

Fix warning on impossible comparison

2015-04-01T05:01:47+00:00

workstation_RFC1001_name is part of the struct and can't be null,
remove impossible comparison (array vs. null)

Pointed out by Coverity (CID 140095)

Signed-off-by: Steve French 
Reviewed-by: Jeff Layton

Fix coverity warning

2015-04-01T05:01:47+00:00

Coverity reports a warning for referencing the beginning of the
SMB2/SMB3 frame using the ProtocolId field as an array. Although
it works the same either way, this patch should quiet the warning
and might be a little clearer.

Reported by Coverity (CID 741269)

Signed-off-by: Steve French 
Acked-by: Shirish Pargaonkar 
Acked-by: Sachin Prabhu 
Reviewed-by: Jeff Layton

Fix dereference before null check warning

2015-04-01T05:01:47+00:00

null tcon is not likely in these paths in current
code, but obviously it does clarify the code to
check for null (if at all) before derefrencing
rather than after.

Reported by Coverity (CID 1042666)

Signed-off-by: Steve French 
Acked-by: Shirish Pargaonkar 
Acked-by: Sachin Prabhu

Don't ignore errors on encrypting password in SMBTcon

2015-04-01T05:01:46+00:00

Although unlikely to fail (and tree connect does not commonly send
a password since SECMODE_USER is the default for most servers)
do not ignore errors on SMBNTEncrypt in SMB Tree Connect.

Reported by Coverity (CID 1226853)

Signed-off-by: Steve French 
Acked-by: Shirish Pargaonkar 
Acked-by: Sachin Prabhu 
Reviewed-by: Jeff Layton

Fix warning on uninitialized buftype

2015-04-01T05:01:46+00:00

Pointed out by coverity analyzer.  resp_buftype is
not initialized in one path which can rarely log
a spurious warning (buf is null so there will
not be a problem with freeing data, but if buf_type
were randomly set to wrong value could log a warning)

Reported by Coverity (CID 1269144)

Signed-off-by: Steve French 
Acked-by: Shirish Pargaonkar 
Acked-by: Sachin Prabhu 
Reviewed-by: Jeff Layton

cifs: potential memory leaks when parsing mnt opts

2015-03-21T17:01:50+00:00

For example, when mount opt is redundently specified
(e.g., "user=A,user=B,user=C"), kernel kept allocating new key/val
with kstrdup() and overwrite previous ptr (to be freed).

Althouhg mount.cifs in userspace performs a bit of sanitization
(e.g., forcing one user option), current implementation is not
robust. Other options such as iocharset and domainanme are similarly
vulnerable.

Signed-off-by: Taesoo Kim 
Signed-off-by: Steve French

cifs: fix use-after-free bug in find_writable_file

2015-03-21T15:56:27+00:00

Under intermittent network outages, find_writable_file() is susceptible
to the following race condition, which results in a user-after-free in
the cifs_writepages code-path:

Thread 1                                        Thread 2
========                                        ========

inv_file = NULL
refind = 0
spin_lock(&cifs_file_list_lock)

// invalidHandle found on openFileList

inv_file = open_file
// inv_file->count currently 1

cifsFileInfo_get(inv_file)
// inv_file->count = 2

spin_unlock(&cifs_file_list_lock);

cifs_reopen_file()                            cifs_close()
// fails (rc != 0)                            ->cifsFileInfo_put()
                                       spin_lock(&cifs_file_list_lock)
                                       // inv_file->count = 1
                                       spin_unlock(&cifs_file_list_lock)

spin_lock(&cifs_file_list_lock);
list_move_tail(&inv_file->flist,
      &cifs_inode->openFileList);
spin_unlock(&cifs_file_list_lock);

cifsFileInfo_put(inv_file);
->spin_lock(&cifs_file_list_lock)

  // inv_file->count = 0
  list_del(&cifs_file->flist);
  // cleanup!!
  kfree(cifs_file);

  spin_unlock(&cifs_file_list_lock);

spin_lock(&cifs_file_list_lock);
++refind;
// refind = 1
goto refind_writable;

At this point we loop back through with an invalid inv_file pointer
and a refind value of 1. On second pass, inv_file is not overwritten on
openFileList traversal, and is subsequently dereferenced.

Signed-off-by: David Disseldorp 
Reviewed-by: Jeff Layton 
CC: 
Signed-off-by: Steve French