linux.git/fs/cifs, branch v6.3

cifs: Reapply lost fix from commit 30b2b2196d6e

2023-04-19T02:26:09+00:00

Reapply the fix from:

   30b2b2196d6e ("cifs: do not include page data when checking signature")

that got lost in the iteratorisation of the cifs driver.

Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Acked-by: Paulo Alcantara (SUSE) 
Reported-by: Paulo Alcantara 
Signed-off-by: David Howells 
cc: Paulo Alcantara 
cc: Shyam Prasad N 
cc: Bharath S M 
cc: Enzo Matsumiya 
cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French

cifs: Fix unbuffered read

2023-04-19T02:22:08+00:00

If read() is done in an unbuffered manner, such that, say,
cifs_strict_readv() goes through cifs_user_readv() and thence
__cifs_readv(), it doesn't recognise the EOF and keeps indicating to
userspace that it returning full buffers of data.

This is due to ctx->iter being advanced in cifs_send_async_read() as the
buffer is split up amongst a number of rdata objects.  The iterator count
is then used in collect_uncached_read_data() in the non-DIO case to set the
total length read - and thus the return value of sys_read().  But since the
iterator normally gets used up completely during splitting, ctx->total_len
gets overridden to the full amount.

However, prior to that in collect_uncached_read_data(), we've gone through
the list of rdatas and added up the amount of data we actually received
(which we then throw away).

Fix this by removing the bit that overrides the amount read in the non-DIO
case and just going with the total added up in the aforementioned loop.

This was observed by mounting a cifs share with multiple channels, e.g.:

	mount //192.168.6.1/test /test/ -o user=shares,pass=...,max_channels=6

and then reading a 1MiB file on the share:

	strace cat /xfstest.test/1M  >/dev/null

Through strace, the same data can be seen being read again and again.

Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Signed-off-by: David Howells 
Acked-by: Paulo Alcantara (SUSE) 
cc: Jérôme Glisse 
cc: Long Li 
cc: Enzo Matsumiya 
cc: Shyam Prasad N 
cc: Rohith Surabattula 
cc: Jeff Layton 
cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French

cifs: avoid dup prefix path in dfs_get_automount_devname()

2023-04-16T23:04:36+00:00

@server->origin_fullpath already contains the tree name + optional
prefix, so avoid calling __build_path_from_dentry_optional_prefix() as
it might end up duplicating prefix path from @cifs_sb->prepath into
final full path.

Instead, generate DFS full path by simply merging
@server->origin_fullpath with dentry's path.

This fixes the following case

	mount.cifs //root/dfs/dir /mnt/ -o ...
	ls /mnt/link

where cifs_dfs_do_automount() will call smb3_parse_devname() with
@devname set to "//root/dfs/dir/link" instead of
"//root/dfs/dir/dir/link".

Fixes: 7ad54b98fc1f ("cifs: use origin fullpath for automounts")
Cc:  # 6.2+
Signed-off-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French

cifs: fix negotiate context parsing

2023-04-15T23:26:56+00:00

smb311_decode_neg_context() doesn't properly check against SMB packet
boundaries prior to accessing individual negotiate context entries. This
is due to the length check omitting the eight byte smb2_neg_context
header, as well as incorrect decrementing of len_of_ctxts.

Fixes: 5100d8a3fe03 ("SMB311: Improve checking of negotiate security contexts")
Reported-by: Volker Lendecke 
Reviewed-by: Paulo Alcantara (SUSE) 
Signed-off-by: David Disseldorp 
Signed-off-by: Steve French

cifs: double lock in cifs_reconnect_tcon()

2023-04-07T03:45:41+00:00

This lock was supposed to be an unlock.

Fixes: 6cc041e90c17 ("cifs: avoid races in parallel reconnects in smb1")
Signed-off-by: Dan Carpenter 
Reviewed-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French

cifs: sanitize paths in cifs_update_super_prepath.

2023-04-05T17:32:19+00:00

After a server reboot, clients are failing to move files with ENOENT.
This is caused by DFS referrals containing multiple separators, which
the server move call doesn't recognize.

v1: Initial patch.
v2: Move prototype to header.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182472
Fixes: a31080899d5f ("cifs: sanitize multiple delimiters in prepath")
Actually-Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api")
Reviewed-by: Paulo Alcantara (SUSE) 
Signed-off-by: Thiago Rafael Becker 
Signed-off-by: Steve French

cifs: get rid of dead check in smb2_reconnect()

2023-03-30T22:56:30+00:00

The SMB2_IOCTL check in the switch statement will never be true as we
return earlier from smb2_reconnect() if @smb2_command == SMB2_IOCTL.

Signed-off-by: Paulo Alcantara (SUSE) 
Reviewed-by: Ronnie Sahlberg 
Signed-off-by: Steve French

cifs: prevent infinite recursion in CIFSGetDFSRefer()

2023-03-30T22:56:27+00:00

We can't call smb_init() in CIFSGetDFSRefer() as cifs_reconnect_tcon()
may end up calling CIFSGetDFSRefer() again to get new DFS referrals
and thus causing an infinite recursion.

Signed-off-by: Paulo Alcantara (SUSE) 
Reviewed-by: Ronnie Sahlberg 
Cc: stable@vger.kernel.org # 6.2
Signed-off-by: Steve French

cifs: avoid races in parallel reconnects in smb1

2023-03-30T22:55:55+00:00

Prevent multiple threads of doing negotiate, session setup and tree
connect by holding @ses->session_mutex in cifs_reconnect_tcon() while
reconnecting session and tcon.

Signed-off-by: Paulo Alcantara (SUSE) 
Reviewed-by: Ronnie Sahlberg 
Signed-off-by: Steve French

cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL

2023-03-30T22:28:44+00:00

When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount
is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to
S_AUTOMOUNT and corresponding dentry flags is retained regardless of
CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in
VFS follow_automount() when traversing a DFS referral link:
  BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  Call Trace:
   
   __traverse_mounts+0xb5/0x220
   ? cifs_revalidate_mapping+0x65/0xc0 [cifs]
   step_into+0x195/0x610
   ? lookup_fast+0xe2/0xf0
   path_lookupat+0x64/0x140
   filename_lookup+0xc2/0x140
   ? __create_object+0x299/0x380
   ? kmem_cache_alloc+0x119/0x220
   ? user_path_at_empty+0x31/0x50
   user_path_at_empty+0x31/0x50
   __x64_sys_chdir+0x2a/0xd0
   ? exit_to_user_mode_prepare+0xca/0x100
   do_syscall_64+0x42/0x90
   entry_SYSCALL_64_after_hwframe+0x72/0xdc

This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler
when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to
avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This
approach was chosen as it provides more control over the error path.

Signed-off-by: David Disseldorp 
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (SUSE) 
Reviewed-by: Ronnie Sahlberg 
Signed-off-by: Steve French