Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6
Pull CIFS fixes from Steve French:
"Five small cifs fixes (includes fixes for: unmount hang, 2 security
related, symlink, large file writes)"
* 'for-linus' of git://git.samba.org/sfrench/cifs-2.6:
cifs: ntstatus_to_dos_map[] is not terminated
cifs: Allow LANMAN auth method for servers supporting unencapsulated authentication methods
cifs: Fix inability to write files >2GB to SMB2/3 shares
cifs: Avoid umount hangs with smb2 when server is unresponsive
do not treat non-symlink reparse points as valid symlinks
+93
-21
+4
-2
fs/cifs/cifsfs.c
+4
-2
fs/cifs/cifsfs.c
···
120
120
{
121
121
struct inode *inode;
122
122
struct cifs_sb_info *cifs_sb;
123
+
struct cifs_tcon *tcon;
123
124
int rc = 0;
124
125
125
126
cifs_sb = CIFS_SB(sb);
127
+
tcon = cifs_sb_master_tcon(cifs_sb);
126
128
127
129
if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIXACL)
128
130
sb->s_flags |= MS_POSIXACL;
129
131
130
-
if (cifs_sb_master_tcon(cifs_sb)->ses->capabilities & CAP_LARGE_FILES)
132
+
if (tcon->ses->capabilities & tcon->ses->server->vals->cap_large_files)
131
133
sb->s_maxbytes = MAX_LFS_FILESIZE;
132
134
else
133
135
sb->s_maxbytes = MAX_NON_LFS;
···
149
147
goto out_no_root;
150
148
}
151
149
152
-
if (cifs_sb_master_tcon(cifs_sb)->nocase)
150
+
if (tcon->nocase)
153
151
sb->s_d_op = &cifs_ci_dentry_ops;
154
152
else
155
153
sb->s_d_op = &cifs_dentry_ops;
+23
-8
fs/cifs/cifspdu.h
+23
-8
fs/cifs/cifspdu.h
···
1491
1491
__u8 FileName[0];
1492
1492
} __attribute__((packed));
1493
1493
1494
-
struct reparse_data {
1495
-
__u32 ReparseTag;
1496
-
__u16 ReparseDataLength;
1494
+
/* For IO_REPARSE_TAG_SYMLINK */
1495
+
struct reparse_symlink_data {
1496
+
__le32 ReparseTag;
1497
+
__le16 ReparseDataLength;
1497
1498
__u16 Reserved;
1498
-
__u16 SubstituteNameOffset;
1499
-
__u16 SubstituteNameLength;
1500
-
__u16 PrintNameOffset;
1501
-
__u16 PrintNameLength;
1502
-
__u32 Flags;
1499
+
__le16 SubstituteNameOffset;
1500
+
__le16 SubstituteNameLength;
1501
+
__le16 PrintNameOffset;
1502
+
__le16 PrintNameLength;
1503
+
__le32 Flags;
1504
+
char PathBuffer[0];
1505
+
} __attribute__((packed));
1506
+
1507
+
/* For IO_REPARSE_TAG_NFS */
1508
+
#define NFS_SPECFILE_LNK 0x00000000014B4E4C
1509
+
#define NFS_SPECFILE_CHR 0x0000000000524843
1510
+
#define NFS_SPECFILE_BLK 0x00000000004B4C42
1511
+
#define NFS_SPECFILE_FIFO 0x000000004F464946
1512
+
#define NFS_SPECFILE_SOCK 0x000000004B434F53
1513
+
struct reparse_posix_data {
1514
+
__le32 ReparseTag;
1515
+
__le16 ReparseDataLength;
1516
+
__u16 Reserved;
1517
+
__le64 InodeType; /* LNK, FIFO, CHR etc. */
1503
1518
char PathBuffer[0];
1504
1519
} __attribute__((packed));
1505
1520
+34
-6
fs/cifs/cifssmb.c
+34
-6
fs/cifs/cifssmb.c
···
3088
3088
bool is_unicode;
3089
3089
unsigned int sub_len;
3090
3090
char *sub_start;
3091
-
struct reparse_data *reparse_buf;
3091
+
struct reparse_symlink_data *reparse_buf;
3092
+
struct reparse_posix_data *posix_buf;
3092
3093
__u32 data_offset, data_count;
3093
3094
char *end_of_smb;
3094
3095
···
3138
3137
goto qreparse_out;
3139
3138
}
3140
3139
end_of_smb = 2 + get_bcc(&pSMBr->hdr) + (char *)&pSMBr->ByteCount;
3141
-
reparse_buf = (struct reparse_data *)
3140
+
reparse_buf = (struct reparse_symlink_data *)
3142
3141
((char *)&pSMBr->hdr.Protocol + data_offset);
3143
3142
if ((char *)reparse_buf >= end_of_smb) {
3144
3143
rc = -EIO;
3145
3144
goto qreparse_out;
3146
3145
}
3147
-
if ((reparse_buf->PathBuffer + reparse_buf->PrintNameOffset +
3148
-
reparse_buf->PrintNameLength) > end_of_smb) {
3146
+
if (reparse_buf->ReparseTag == cpu_to_le32(IO_REPARSE_TAG_NFS)) {
3147
+
cifs_dbg(FYI, "NFS style reparse tag\n");
3148
+
posix_buf = (struct reparse_posix_data *)reparse_buf;
3149
+
3150
+
if (posix_buf->InodeType != cpu_to_le64(NFS_SPECFILE_LNK)) {
3151
+
cifs_dbg(FYI, "unsupported file type 0x%llx\n",
3152
+
le64_to_cpu(posix_buf->InodeType));
3153
+
rc = -EOPNOTSUPP;
3154
+
goto qreparse_out;
3155
+
}
3156
+
is_unicode = true;
3157
+
sub_len = le16_to_cpu(reparse_buf->ReparseDataLength);
3158
+
if (posix_buf->PathBuffer + sub_len > end_of_smb) {
3159
+
cifs_dbg(FYI, "reparse buf beyond SMB\n");
3160
+
rc = -EIO;
3161
+
goto qreparse_out;
3162
+
}
3163
+
*symlinkinfo = cifs_strndup_from_utf16(posix_buf->PathBuffer,
3164
+
sub_len, is_unicode, nls_codepage);
3165
+
goto qreparse_out;
3166
+
} else if (reparse_buf->ReparseTag !=
3167
+
cpu_to_le32(IO_REPARSE_TAG_SYMLINK)) {
3168
+
rc = -EOPNOTSUPP;
3169
+
goto qreparse_out;
3170
+
}
3171
+
3172
+
/* Reparse tag is NTFS symlink */
3173
+
sub_start = le16_to_cpu(reparse_buf->SubstituteNameOffset) +
3174
+
reparse_buf->PathBuffer;
3175
+
sub_len = le16_to_cpu(reparse_buf->SubstituteNameLength);
3176
+
if (sub_start + sub_len > end_of_smb) {
3149
3177
cifs_dbg(FYI, "reparse buf beyond SMB\n");
3150
3178
rc = -EIO;
3151
3179
goto qreparse_out;
3152
3180
}
3153
-
sub_start = reparse_buf->SubstituteNameOffset + reparse_buf->PathBuffer;
3154
-
sub_len = reparse_buf->SubstituteNameLength;
3155
3181
if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE)
3156
3182
is_unicode = true;
3157
3183
else
+3
-1
fs/cifs/netmisc.c
+3
-1
fs/cifs/netmisc.c
···
780
780
ERRDOS, ERRnoaccess, 0xc0000290}, {
781
781
ERRDOS, ERRbadfunc, 0xc000029c}, {
782
782
ERRDOS, ERRsymlink, NT_STATUS_STOPPED_ON_SYMLINK}, {
783
-
ERRDOS, ERRinvlevel, 0x007c0001}, };
783
+
ERRDOS, ERRinvlevel, 0x007c0001}, {
784
+
0, 0, 0 }
785
+
};
784
786
785
787
/*****************************************************************************
786
788
Print an error message from the status code
+2
-2
fs/cifs/sess.c
+2
-2
fs/cifs/sess.c
···
500
500
return NTLMv2;
501
501
if (global_secflags & CIFSSEC_MAY_NTLM)
502
502
return NTLM;
503
-
/* Fallthrough */
504
503
default:
505
-
return Unspecified;
504
+
/* Fallthrough to attempt LANMAN authentication next */
505
+
break;
506
506
}
507
507
case CIFS_NEGFLAVOR_LANMAN:
508
508
switch (requested) {
+6
fs/cifs/smb2pdu.c
+6
fs/cifs/smb2pdu.c
···
687
687
else
688
688
return -EIO;
689
689
690
+
/* no need to send SMB logoff if uid already closed due to reconnect */
691
+
if (ses->need_reconnect)
692
+
goto smb2_session_already_dead;
693
+
690
694
rc = small_smb2_init(SMB2_LOGOFF, NULL, (void **) &req);
691
695
if (rc)
692
696
return rc;
···
705
701
* No tcon so can't do
706
702
* cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
707
703
*/
704
+
705
+
smb2_session_already_dead:
708
706
return rc;
709
707
}
710
708
+14
fs/cifs/smbfsctl.h
+14
fs/cifs/smbfsctl.h
···
97
97
#define FSCTL_QUERY_NETWORK_INTERFACE_INFO 0x001401FC /* BB add struct */
98
98
#define FSCTL_SRV_READ_HASH 0x001441BB /* BB add struct */
99
99
100
+
/* See FSCC 2.1.2.5 */
100
101
#define IO_REPARSE_TAG_MOUNT_POINT 0xA0000003
101
102
#define IO_REPARSE_TAG_HSM 0xC0000004
102
103
#define IO_REPARSE_TAG_SIS 0x80000007
104
+
#define IO_REPARSE_TAG_HSM2 0x80000006
105
+
#define IO_REPARSE_TAG_DRIVER_EXTENDER 0x80000005
106
+
/* Used by the DFS filter. See MS-DFSC */
107
+
#define IO_REPARSE_TAG_DFS 0x8000000A
108
+
/* Used by the DFS filter See MS-DFSC */
109
+
#define IO_REPARSE_TAG_DFSR 0x80000012
110
+
#define IO_REPARSE_TAG_FILTER_MANAGER 0x8000000B
111
+
/* See section MS-FSCC 2.1.2.4 */
112
+
#define IO_REPARSE_TAG_SYMLINK 0xA000000C
113
+
#define IO_REPARSE_TAG_DEDUP 0x80000013
114
+
#define IO_REPARSE_APPXSTREAM 0xC0000014
115
+
/* NFS symlinks, Win 8/SMB3 and later */
116
+
#define IO_REPARSE_TAG_NFS 0x80000014
103
117
104
118
/* fsctl flags */
105
119
/* If Flags is set to this value, the request is an FSCTL not ioctl request */
+7
-2
fs/cifs/transport.c
+7
-2
fs/cifs/transport.c
···
410
410
wait_for_free_request(struct TCP_Server_Info *server, const int timeout,
411
411
const int optype)
412
412
{
413
-
return wait_for_free_credits(server, timeout,
414
-
server->ops->get_credits_field(server, optype));
413
+
int *val;
414
+
415
+
val = server->ops->get_credits_field(server, optype);
416
+
/* Since an echo is already inflight, no need to wait to send another */
417
+
if (*val <= 0 && optype == CIFS_ECHO_OP)
418
+
return -EAGAIN;
419
+
return wait_for_free_credits(server, timeout, val);
415
420
}
416
421
417
422
static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,