Merge tag '5.15-rc-ksmbd-part2' of git://git.samba.org/ksmbd

tjh.dev / kernel

fork

Configure Feed

Issues Pull Requests Commits Tags

Feed URL

Select the types of activity you want to include in your feed.

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

fork

Configure Feed

Issues Pull Requests Commits Tags

Feed URL

Select the types of activity you want to include in your feed.

Merge tag '5.15-rc-ksmbd-part2' of git://git.samba.org/ksmbd

Pull ksmbd fixes from Steve French:

- various fixes pointed out by coverity, and a minor cleanup patch

- id mapping and ownership fixes

- an smbdirect fix

* tag '5.15-rc-ksmbd-part2' of git://git.samba.org/ksmbd:
ksmbd: fix control flow issues in sid_to_id()
ksmbd: fix read of uninitialized variable ret in set_file_basic_info
ksmbd: add missing assignments to ret on ndr_read_int64 read calls
ksmbd: add validation for ndr read/write functions
ksmbd: remove unused ksmbd_file_table_flush function
ksmbd: smbd: fix dma mapping error in smb_direct_post_send_data
ksmbd: Reduce error log 'speed is unknown' to debug
ksmbd: defer notify_change() call
ksmbd: remove setattr preparations in set_file_basic_info()
ksmbd: ensure error is surfaced in set_file_basic_info()
ndr: fix translation in ndr_encode_posix_acl()
ksmbd: fix translation in sid_to_id()
ksmbd: fix subauth 0 handling in sid_to_id()
ksmbd: fix translation in acl entries
ksmbd: fix translation in ksmbd_acls_fattr()
ksmbd: fix translation in create_posix_rsp_buf()
ksmbd: fix translation in smb2_populate_readdir_entry()
ksmbd: fix lookup on idmapped mounts

Linus Torvalds 4 years ago bf9f243f 8dde2086

+412 -222

12 changed files

expand all collapse all

ksmbd

ndr.c

oplock.c

smb2pdu.c

smb_common.c

smb_common.h

smbacl.c

smbacl.h

transport_rdma.c

vfs.c

vfs.h

vfs_cache.c

vfs_cache.h

+273 -108

fs/ksmbd/ndr.c

reviewed

··· 28 28 return 0; 29 29 } 30 30 31 31 - static void ndr_write_int16(struct ndr *n, __u16 value) 31 31 + static int ndr_write_int16(struct ndr *n, __u16 value) 32 32 { 33 33 - if (n->length <= n->offset + sizeof(value)) 34 34 - try_to_realloc_ndr_blob(n, sizeof(value)); 33 33 + if (n->length <= n->offset + sizeof(value)) { 34 34 + int ret; 35 35 + 36 36 + ret = try_to_realloc_ndr_blob(n, sizeof(value)); 37 37 + if (ret) 38 38 + return ret; 39 39 + } 35 40 36 41 *(__le16 *)ndr_get_field(n) = cpu_to_le16(value); 37 42 n->offset += sizeof(value); 43 43 + return 0; 38 44 } 39 45 40 40 - static void ndr_write_int32(struct ndr *n, __u32 value) 46 46 + static int ndr_write_int32(struct ndr *n, __u32 value) 41 47 { 42 42 - if (n->length <= n->offset + sizeof(value)) 43 43 - try_to_realloc_ndr_blob(n, sizeof(value)); 48 48 + if (n->length <= n->offset + sizeof(value)) { 49 49 + int ret; 50 50 + 51 51 + ret = try_to_realloc_ndr_blob(n, sizeof(value)); 52 52 + if (ret) 53 53 + return ret; 54 54 + } 44 55 45 56 *(__le32 *)ndr_get_field(n) = cpu_to_le32(value); 46 57 n->offset += sizeof(value); 58 58 + return 0; 47 59 } 48 60 49 49 - static void ndr_write_int64(struct ndr *n, __u64 value) 61 61 + static int ndr_write_int64(struct ndr *n, __u64 value) 50 62 { 51 51 - if (n->length <= n->offset + sizeof(value)) 52 52 - try_to_realloc_ndr_blob(n, sizeof(value)); 63 63 + if (n->length <= n->offset + sizeof(value)) { 64 64 + int ret; 65 65 + 66 66 + ret = try_to_realloc_ndr_blob(n, sizeof(value)); 67 67 + if (ret) 68 68 + return ret; 69 69 + } 53 70 54 71 *(__le64 *)ndr_get_field(n) = cpu_to_le64(value); 55 72 n->offset += sizeof(value); 73 73 + return 0; 56 74 } 57 75 58 76 static int ndr_write_bytes(struct ndr *n, void *value, size_t sz) 59 77 { 60 60 - if (n->length <= n->offset + sz) 61 61 - try_to_realloc_ndr_blob(n, sz); 78 78 + if (n->length <= n->offset + sz) { 79 79 + int ret; 80 80 + 81 81 + ret = try_to_realloc_ndr_blob(n, sz); 82 82 + if (ret) 83 83 + return ret; 84 84 + } 62 85 63 86 memcpy(ndr_get_field(n), value, sz); 64 87 n->offset += sz; ··· 93 70 size_t sz; 94 71 95 72 sz = strlen(value) + 1; 96 96 - if (n->length <= n->offset + sz) 97 97 - try_to_realloc_ndr_blob(n, sz); 73 73 + if (n->length <= n->offset + sz) { 74 74 + int ret; 75 75 + 76 76 + ret = try_to_realloc_ndr_blob(n, sz); 77 77 + if (ret) 78 78 + return ret; 79 79 + } 98 80 99 81 memcpy(ndr_get_field(n), value, sz); 100 82 n->offset += sz; ··· 109 81 110 82 static int ndr_read_string(struct ndr *n, void *value, size_t sz) 111 83 { 112 112 - int len = strnlen(ndr_get_field(n), sz); 84 84 + int len; 113 85 114 114 - memcpy(value, ndr_get_field(n), len); 86 86 + if (n->offset + sz > n->length) 87 87 + return -EINVAL; 88 88 + 89 89 + len = strnlen(ndr_get_field(n), sz); 90 90 + if (value) 91 91 + memcpy(value, ndr_get_field(n), len); 115 92 len++; 116 93 n->offset += len; 117 94 n->offset = ALIGN(n->offset, 2); ··· 125 92 126 93 static int ndr_read_bytes(struct ndr *n, void *value, size_t sz) 127 94 { 128 128 - memcpy(value, ndr_get_field(n), sz); 95 95 + if (n->offset + sz > n->length) 96 96 + return -EINVAL; 97 97 + 98 98 + if (value) 99 99 + memcpy(value, ndr_get_field(n), sz); 129 100 n->offset += sz; 130 101 return 0; 131 102 } 132 103 133 133 - static __u16 ndr_read_int16(struct ndr *n) 104 104 + static int ndr_read_int16(struct ndr *n, __u16 *value) 134 105 { 135 135 - __u16 ret; 106 106 + if (n->offset + sizeof(__u16) > n->length) 107 107 + return -EINVAL; 136 108 137 137 - ret = le16_to_cpu(*(__le16 *)ndr_get_field(n)); 109 109 + if (value) 110 110 + *value = le16_to_cpu(*(__le16 *)ndr_get_field(n)); 138 111 n->offset += sizeof(__u16); 139 139 - return ret; 112 112 + return 0; 140 113 } 141 114 142 142 - static __u32 ndr_read_int32(struct ndr *n) 115 115 + static int ndr_read_int32(struct ndr *n, __u32 *value) 143 116 { 144 144 - __u32 ret; 117 117 + if (n->offset + sizeof(__u32) > n->length) 118 118 + return 0; 145 119 146 146 - ret = le32_to_cpu(*(__le32 *)ndr_get_field(n)); 120 120 + if (value) 121 121 + *value = le32_to_cpu(*(__le32 *)ndr_get_field(n)); 147 122 n->offset += sizeof(__u32); 148 148 - return ret; 123 123 + return 0; 149 124 } 150 125 151 151 - static __u64 ndr_read_int64(struct ndr *n) 126 126 + static int ndr_read_int64(struct ndr *n, __u64 *value) 152 127 { 153 153 - __u64 ret; 128 128 + if (n->offset + sizeof(__u64) > n->length) 129 129 + return -EINVAL; 154 130 155 155 - ret = le64_to_cpu(*(__le64 *)ndr_get_field(n)); 131 131 + if (value) 132 132 + *value = le64_to_cpu(*(__le64 *)ndr_get_field(n)); 156 133 n->offset += sizeof(__u64); 157 157 - return ret; 134 134 + return 0; 158 135 } 159 136 160 137 int ndr_encode_dos_attr(struct ndr *n, struct xattr_dos_attrib *da) 161 138 { 162 139 char hex_attr[12] = {0}; 140 140 + int ret; 163 141 164 142 n->offset = 0; 165 143 n->length = 1024; ··· 180 136 181 137 if (da->version == 3) { 182 138 snprintf(hex_attr, 10, "0x%x", da->attr); 183 183 - ndr_write_string(n, hex_attr); 139 139 + ret = ndr_write_string(n, hex_attr); 184 140 } else { 185 185 - ndr_write_string(n, ""); 141 141 + ret = ndr_write_string(n, ""); 186 142 } 187 187 - ndr_write_int16(n, da->version); 188 188 - ndr_write_int32(n, da->version); 143 143 + if (ret) 144 144 + return ret; 189 145 190 190 - ndr_write_int32(n, da->flags); 191 191 - ndr_write_int32(n, da->attr); 146 146 + ret = ndr_write_int16(n, da->version); 147 147 + if (ret) 148 148 + return ret; 149 149 + 150 150 + ret = ndr_write_int32(n, da->version); 151 151 + if (ret) 152 152 + return ret; 153 153 + 154 154 + ret = ndr_write_int32(n, da->flags); 155 155 + if (ret) 156 156 + return ret; 157 157 + 158 158 + ret = ndr_write_int32(n, da->attr); 159 159 + if (ret) 160 160 + return ret; 161 161 + 192 162 if (da->version == 3) { 193 193 - ndr_write_int32(n, da->ea_size); 194 194 - ndr_write_int64(n, da->size); 195 195 - ndr_write_int64(n, da->alloc_size); 163 163 + ret = ndr_write_int32(n, da->ea_size); 164 164 + if (ret) 165 165 + return ret; 166 166 + ret = ndr_write_int64(n, da->size); 167 167 + if (ret) 168 168 + return ret; 169 169 + ret = ndr_write_int64(n, da->alloc_size); 196 170 } else { 197 197 - ndr_write_int64(n, da->itime); 171 171 + ret = ndr_write_int64(n, da->itime); 198 172 } 199 199 - ndr_write_int64(n, da->create_time); 173 173 + if (ret) 174 174 + return ret; 175 175 + 176 176 + ret = ndr_write_int64(n, da->create_time); 177 177 + if (ret) 178 178 + return ret; 179 179 + 200 180 if (da->version == 3) 201 201 - ndr_write_int64(n, da->change_time); 202 202 - return 0; 181 181 + ret = ndr_write_int64(n, da->change_time); 182 182 + return ret; 203 183 } 204 184 205 185 int ndr_decode_dos_attr(struct ndr *n, struct xattr_dos_attrib *da) 206 186 { 207 207 - char *hex_attr; 208 208 - int version2; 209 209 - 210 210 - hex_attr = kzalloc(n->length, GFP_KERNEL); 211 211 - if (!hex_attr) 212 212 - return -ENOMEM; 187 187 + char hex_attr[12]; 188 188 + unsigned int version2; 189 189 + int ret; 213 190 214 191 n->offset = 0; 215 215 - ndr_read_string(n, hex_attr, n->length); 216 216 - kfree(hex_attr); 217 217 - da->version = ndr_read_int16(n); 192 192 + ret = ndr_read_string(n, hex_attr, sizeof(hex_attr)); 193 193 + if (ret) 194 194 + return ret; 195 195 + 196 196 + ret = ndr_read_int16(n, &da->version); 197 197 + if (ret) 198 198 + return ret; 218 199 219 200 if (da->version != 3 && da->version != 4) { 220 201 pr_err("v%d version is not supported\n", da->version); 221 202 return -EINVAL; 222 203 } 223 204 224 224 - version2 = ndr_read_int32(n); 205 205 + ret = ndr_read_int32(n, &version2); 206 206 + if (ret) 207 207 + return ret; 208 208 + 225 209 if (da->version != version2) { 226 210 pr_err("ndr version mismatched(version: %d, version2: %d)\n", 227 211 da->version, version2); 228 212 return -EINVAL; 229 213 } 230 214 231 231 - ndr_read_int32(n); 232 232 - da->attr = ndr_read_int32(n); 215 215 + ret = ndr_read_int32(n, NULL); 216 216 + if (ret) 217 217 + return ret; 218 218 + 219 219 + ret = ndr_read_int32(n, &da->attr); 220 220 + if (ret) 221 221 + return ret; 222 222 + 233 223 if (da->version == 4) { 234 234 - da->itime = ndr_read_int64(n); 235 235 - da->create_time = ndr_read_int64(n); 224 224 + ret = ndr_read_int64(n, &da->itime); 225 225 + if (ret) 226 226 + return ret; 227 227 + 228 228 + ret = ndr_read_int64(n, &da->create_time); 236 229 } else { 237 237 - ndr_read_int32(n); 238 238 - ndr_read_int64(n); 239 239 - ndr_read_int64(n); 240 240 - da->create_time = ndr_read_int64(n); 241 241 - ndr_read_int64(n); 230 230 + ret = ndr_read_int32(n, NULL); 231 231 + if (ret) 232 232 + return ret; 233 233 + 234 234 + ret = ndr_read_int64(n, NULL); 235 235 + if (ret) 236 236 + return ret; 237 237 + 238 238 + ret = ndr_read_int64(n, NULL); 239 239 + if (ret) 240 240 + return ret; 241 241 + 242 242 + ret = ndr_read_int64(n, &da->create_time); 243 243 + if (ret) 244 244 + return ret; 245 245 + 246 246 + ret = ndr_read_int64(n, NULL); 242 247 } 243 248 244 244 - return 0; 249 249 + return ret; 245 250 } 246 251 247 252 static int ndr_encode_posix_acl_entry(struct ndr *n, struct xattr_smb_acl *acl) 248 253 { 249 249 - int i; 254 254 + int i, ret; 250 255 251 251 - ndr_write_int32(n, acl->count); 256 256 + ret = ndr_write_int32(n, acl->count); 257 257 + if (ret) 258 258 + return ret; 259 259 + 252 260 n->offset = ALIGN(n->offset, 8); 253 253 - ndr_write_int32(n, acl->count); 254 254 - ndr_write_int32(n, 0); 261 261 + ret = ndr_write_int32(n, acl->count); 262 262 + if (ret) 263 263 + return ret; 264 264 + 265 265 + ret = ndr_write_int32(n, 0); 266 266 + if (ret) 267 267 + return ret; 255 268 256 269 for (i = 0; i < acl->count; i++) { 257 270 n->offset = ALIGN(n->offset, 8); 258 258 - ndr_write_int16(n, acl->entries[i].type); 259 259 - ndr_write_int16(n, acl->entries[i].type); 271 271 + ret = ndr_write_int16(n, acl->entries[i].type); 272 272 + if (ret) 273 273 + return ret; 274 274 + 275 275 + ret = ndr_write_int16(n, acl->entries[i].type); 276 276 + if (ret) 277 277 + return ret; 260 278 261 279 if (acl->entries[i].type == SMB_ACL_USER) { 262 280 n->offset = ALIGN(n->offset, 8); 263 263 - ndr_write_int64(n, acl->entries[i].uid); 281 281 + ret = ndr_write_int64(n, acl->entries[i].uid); 264 282 } else if (acl->entries[i].type == SMB_ACL_GROUP) { 265 283 n->offset = ALIGN(n->offset, 8); 266 266 - ndr_write_int64(n, acl->entries[i].gid); 284 284 + ret = ndr_write_int64(n, acl->entries[i].gid); 267 285 } 286 286 + if (ret) 287 287 + return ret; 268 288 269 289 /* push permission */ 270 270 - ndr_write_int32(n, acl->entries[i].perm); 290 290 + ret = ndr_write_int32(n, acl->entries[i].perm); 271 291 } 272 292 273 273 - return 0; 293 293 + return ret; 274 294 } 275 295 276 296 int ndr_encode_posix_acl(struct ndr *n, ··· 343 235 struct xattr_smb_acl *acl, 344 236 struct xattr_smb_acl *def_acl) 345 237 { 346 346 - int ref_id = 0x00020000; 238 238 + unsigned int ref_id = 0x00020000; 239 239 + int ret; 347 240 348 241 n->offset = 0; 349 242 n->length = 1024; ··· 354 245 355 246 if (acl) { 356 247 /* ACL ACCESS */ 357 357 - ndr_write_int32(n, ref_id); 248 248 + ret = ndr_write_int32(n, ref_id); 358 249 ref_id += 4; 359 250 } else { 360 360 - ndr_write_int32(n, 0); 251 251 + ret = ndr_write_int32(n, 0); 361 252 } 253 253 + if (ret) 254 254 + return ret; 362 255 363 256 if (def_acl) { 364 257 /* DEFAULT ACL ACCESS */ 365 365 - ndr_write_int32(n, ref_id); 258 258 + ret = ndr_write_int32(n, ref_id); 366 259 ref_id += 4; 367 260 } else { 368 368 - ndr_write_int32(n, 0); 261 261 + ret = ndr_write_int32(n, 0); 369 262 } 263 263 + if (ret) 264 264 + return ret; 370 265 371 371 - ndr_write_int64(n, from_kuid(user_ns, inode->i_uid)); 372 372 - ndr_write_int64(n, from_kgid(user_ns, inode->i_gid)); 373 373 - ndr_write_int32(n, inode->i_mode); 266 266 + ret = ndr_write_int64(n, from_kuid(&init_user_ns, i_uid_into_mnt(user_ns, inode))); 267 267 + if (ret) 268 268 + return ret; 269 269 + ret = ndr_write_int64(n, from_kgid(&init_user_ns, i_gid_into_mnt(user_ns, inode))); 270 270 + if (ret) 271 271 + return ret; 272 272 + ret = ndr_write_int32(n, inode->i_mode); 273 273 + if (ret) 274 274 + return ret; 374 275 375 276 if (acl) { 376 376 - ndr_encode_posix_acl_entry(n, acl); 377 377 - if (def_acl) 378 378 - ndr_encode_posix_acl_entry(n, def_acl); 277 277 + ret = ndr_encode_posix_acl_entry(n, acl); 278 278 + if (def_acl && !ret) 279 279 + ret = ndr_encode_posix_acl_entry(n, def_acl); 379 280 } 380 380 - return 0; 281 281 + return ret; 381 282 } 382 283 383 284 int ndr_encode_v4_ntacl(struct ndr *n, struct xattr_ntacl *acl) 384 285 { 385 385 - int ref_id = 0x00020004; 286 286 + unsigned int ref_id = 0x00020004; 287 287 + int ret; 386 288 387 289 n->offset = 0; 388 290 n->length = 2048; ··· 401 281 if (!n->data) 402 282 return -ENOMEM; 403 283 404 404 - ndr_write_int16(n, acl->version); 405 405 - ndr_write_int32(n, acl->version); 406 406 - ndr_write_int16(n, 2); 407 407 - ndr_write_int32(n, ref_id); 284 284 + ret = ndr_write_int16(n, acl->version); 285 285 + if (ret) 286 286 + return ret; 287 287 + 288 288 + ret = ndr_write_int32(n, acl->version); 289 289 + if (ret) 290 290 + return ret; 291 291 + 292 292 + ret = ndr_write_int16(n, 2); 293 293 + if (ret) 294 294 + return ret; 295 295 + 296 296 + ret = ndr_write_int32(n, ref_id); 297 297 + if (ret) 298 298 + return ret; 408 299 409 300 /* push hash type and hash 64bytes */ 410 410 - ndr_write_int16(n, acl->hash_type); 411 411 - ndr_write_bytes(n, acl->hash, XATTR_SD_HASH_SIZE); 412 412 - ndr_write_bytes(n, acl->desc, acl->desc_len); 413 413 - ndr_write_int64(n, acl->current_time); 414 414 - ndr_write_bytes(n, acl->posix_acl_hash, XATTR_SD_HASH_SIZE); 301 301 + ret = ndr_write_int16(n, acl->hash_type); 302 302 + if (ret) 303 303 + return ret; 304 304 + 305 305 + ret = ndr_write_bytes(n, acl->hash, XATTR_SD_HASH_SIZE); 306 306 + if (ret) 307 307 + return ret; 308 308 + 309 309 + ret = ndr_write_bytes(n, acl->desc, acl->desc_len); 310 310 + if (ret) 311 311 + return ret; 312 312 + 313 313 + ret = ndr_write_int64(n, acl->current_time); 314 314 + if (ret) 315 315 + return ret; 316 316 + 317 317 + ret = ndr_write_bytes(n, acl->posix_acl_hash, XATTR_SD_HASH_SIZE); 318 318 + if (ret) 319 319 + return ret; 415 320 416 321 /* push ndr for security descriptor */ 417 417 - ndr_write_bytes(n, acl->sd_buf, acl->sd_size); 418 418 - 419 419 - return 0; 322 322 + ret = ndr_write_bytes(n, acl->sd_buf, acl->sd_size); 323 323 + return ret; 420 324 } 421 325 422 326 int ndr_decode_v4_ntacl(struct ndr *n, struct xattr_ntacl *acl) 423 327 { 424 424 - int version2; 328 328 + unsigned int version2; 329 329 + int ret; 425 330 426 331 n->offset = 0; 427 427 - acl->version = ndr_read_int16(n); 332 332 + ret = ndr_read_int16(n, &acl->version); 333 333 + if (ret) 334 334 + return ret; 428 335 if (acl->version != 4) { 429 336 pr_err("v%d version is not supported\n", acl->version); 430 337 return -EINVAL; 431 338 } 432 339 433 433 - version2 = ndr_read_int32(n); 340 340 + ret = ndr_read_int32(n, &version2); 341 341 + if (ret) 342 342 + return ret; 434 343 if (acl->version != version2) { 435 344 pr_err("ndr version mismatched(version: %d, version2: %d)\n", 436 345 acl->version, version2); ··· 467 318 } 468 319 469 320 /* Read Level */ 470 470 - ndr_read_int16(n); 321 321 + ret = ndr_read_int16(n, NULL); 322 322 + if (ret) 323 323 + return ret; 324 324 + 471 325 /* Read Ref Id */ 472 472 - ndr_read_int32(n); 473 473 - acl->hash_type = ndr_read_int16(n); 474 474 - ndr_read_bytes(n, acl->hash, XATTR_SD_HASH_SIZE); 326 326 + ret = ndr_read_int32(n, NULL); 327 327 + if (ret) 328 328 + return ret; 329 329 + 330 330 + ret = ndr_read_int16(n, &acl->hash_type); 331 331 + if (ret) 332 332 + return ret; 333 333 + 334 334 + ret = ndr_read_bytes(n, acl->hash, XATTR_SD_HASH_SIZE); 335 335 + if (ret) 336 336 + return ret; 475 337 476 338 ndr_read_bytes(n, acl->desc, 10); 477 339 if (strncmp(acl->desc, "posix_acl", 9)) { ··· 491 331 } 492 332 493 333 /* Read Time */ 494 494 - ndr_read_int64(n); 334 334 + ret = ndr_read_int64(n, NULL); 335 335 + if (ret) 336 336 + return ret; 337 337 + 495 338 /* Read Posix ACL hash */ 496 496 - ndr_read_bytes(n, acl->posix_acl_hash, XATTR_SD_HASH_SIZE); 339 339 + ret = ndr_read_bytes(n, acl->posix_acl_hash, XATTR_SD_HASH_SIZE); 340 340 + if (ret) 341 341 + return ret; 342 342 + 497 343 acl->sd_size = n->length - n->offset; 498 344 acl->sd_buf = kzalloc(acl->sd_size, GFP_KERNEL); 499 345 if (!acl->sd_buf) 500 346 return -ENOMEM; 501 347 502 502 - ndr_read_bytes(n, acl->sd_buf, acl->sd_size); 503 503 - 504 504 - return 0; 348 348 + ret = ndr_read_bytes(n, acl->sd_buf, acl->sd_size); 349 349 + return ret; 505 350 }

+4 -2

fs/ksmbd/oplock.c

reviewed

··· 1614 1614 buf->nlink = cpu_to_le32(inode->i_nlink); 1615 1615 buf->reparse_tag = cpu_to_le32(fp->volatile_id); 1616 1616 buf->mode = cpu_to_le32(inode->i_mode); 1617 1617 - id_to_sid(from_kuid(user_ns, inode->i_uid), 1617 1617 + id_to_sid(from_kuid_munged(&init_user_ns, 1618 1618 + i_uid_into_mnt(user_ns, inode)), 1618 1619 SIDNFS_USER, (struct smb_sid *)&buf->SidBuffer[0]); 1619 1619 - id_to_sid(from_kgid(user_ns, inode->i_gid), 1620 1620 + id_to_sid(from_kgid_munged(&init_user_ns, 1621 1621 + i_gid_into_mnt(user_ns, inode)), 1620 1622 SIDNFS_GROUP, (struct smb_sid *)&buf->SidBuffer[20]); 1621 1623 } 1622 1624

+32 -37

fs/ksmbd/smb2pdu.c

reviewed

··· 2381 2381 le32_to_cpu(sd_buf->ccontext.DataLength), true); 2382 2382 } 2383 2383 2384 2384 - static void ksmbd_acls_fattr(struct smb_fattr *fattr, struct inode *inode) 2384 2384 + static void ksmbd_acls_fattr(struct smb_fattr *fattr, 2385 2385 + struct user_namespace *mnt_userns, 2386 2386 + struct inode *inode) 2385 2387 { 2386 2386 - fattr->cf_uid = inode->i_uid; 2387 2387 - fattr->cf_gid = inode->i_gid; 2388 2388 + fattr->cf_uid = i_uid_into_mnt(mnt_userns, inode); 2389 2389 + fattr->cf_gid = i_gid_into_mnt(mnt_userns, inode); 2388 2390 fattr->cf_mode = inode->i_mode; 2389 2391 fattr->cf_acls = NULL; 2390 2392 fattr->cf_dacls = NULL; ··· 2895 2893 struct smb_ntsd *pntsd; 2896 2894 int pntsd_size, ace_num = 0; 2897 2895 2898 2898 - ksmbd_acls_fattr(&fattr, inode); 2896 2896 + ksmbd_acls_fattr(&fattr, user_ns, inode); 2899 2897 if (fattr.cf_acls) 2900 2898 ace_num = fattr.cf_acls->a_count; 2901 2899 if (fattr.cf_dacls) ··· 3326 3324 */ 3327 3325 static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, 3328 3326 struct ksmbd_dir_info *d_info, 3329 3329 - struct user_namespace *user_ns, 3330 3327 struct ksmbd_kstat *ksmbd_kstat) 3331 3328 { 3332 3329 int next_entry_offset = 0; ··· 3479 3478 S_ISDIR(ksmbd_kstat->kstat->mode) ? ATTR_DIRECTORY_LE : ATTR_ARCHIVE_LE; 3480 3479 if (d_info->hide_dot_file && d_info->name[0] == '.') 3481 3480 posix_info->DosAttributes |= ATTR_HIDDEN_LE; 3482 3482 - id_to_sid(from_kuid(user_ns, ksmbd_kstat->kstat->uid), 3481 3481 + id_to_sid(from_kuid_munged(&init_user_ns, ksmbd_kstat->kstat->uid), 3483 3482 SIDNFS_USER, (struct smb_sid *)&posix_info->SidBuffer[0]); 3484 3484 - id_to_sid(from_kgid(user_ns, ksmbd_kstat->kstat->gid), 3483 3483 + id_to_sid(from_kgid_munged(&init_user_ns, ksmbd_kstat->kstat->gid), 3485 3484 SIDNFS_GROUP, (struct smb_sid *)&posix_info->SidBuffer[20]); 3486 3485 memcpy(posix_info->name, conv_name, conv_len); 3487 3486 posix_info->name_len = cpu_to_le32(conv_len); ··· 3544 3543 return -EINVAL; 3545 3544 3546 3545 lock_dir(priv->dir_fp); 3547 3547 - dent = lookup_one_len(priv->d_info->name, 3548 3548 - priv->dir_fp->filp->f_path.dentry, 3549 3549 - priv->d_info->name_len); 3546 3546 + dent = lookup_one(user_ns, priv->d_info->name, 3547 3547 + priv->dir_fp->filp->f_path.dentry, 3548 3548 + priv->d_info->name_len); 3550 3549 unlock_dir(priv->dir_fp); 3551 3550 3552 3551 if (IS_ERR(dent)) { ··· 3572 3571 rc = smb2_populate_readdir_entry(priv->work->conn, 3573 3572 priv->info_level, 3574 3573 priv->d_info, 3575 3575 - user_ns, 3576 3574 &ksmbd_kstat); 3577 3575 dput(dent); 3578 3576 if (rc) ··· 5008 5008 5009 5009 user_ns = file_mnt_user_ns(fp->filp); 5010 5010 inode = file_inode(fp->filp); 5011 5011 - ksmbd_acls_fattr(&fattr, inode); 5011 5011 + ksmbd_acls_fattr(&fattr, user_ns, inode); 5012 5012 5013 5013 if (test_share_config_flag(work->tcon->share_conf, 5014 5014 KSMBD_SHARE_FLAG_ACL_XATTR)) ··· 5246 5246 return 0; 5247 5247 } 5248 5248 5249 5249 - static int smb2_rename(struct ksmbd_work *work, struct ksmbd_file *fp, 5249 5249 + static int smb2_rename(struct ksmbd_work *work, 5250 5250 + struct ksmbd_file *fp, 5251 5251 + struct user_namespace *user_ns, 5250 5252 struct smb2_file_rename_info *file_info, 5251 5253 struct nls_table *local_nls) 5252 5254 { ··· 5312 5310 if (rc) 5313 5311 goto out; 5314 5312 5315 5315 - rc = ksmbd_vfs_setxattr(file_mnt_user_ns(fp->filp), 5313 5313 + rc = ksmbd_vfs_setxattr(user_ns, 5316 5314 fp->filp->f_path.dentry, 5317 5315 xattr_stream_name, 5318 5316 NULL, 0, 0); ··· 5440 5438 { 5441 5439 struct smb2_file_all_info *file_info; 5442 5440 struct iattr attrs; 5443 5443 - struct iattr temp_attrs; 5441 5441 + struct timespec64 ctime; 5444 5442 struct file *filp; 5445 5443 struct inode *inode; 5446 5444 struct user_namespace *user_ns; 5447 5447 - int rc; 5445 5445 + int rc = 0; 5448 5446 5449 5447 if (!(fp->daccess & FILE_WRITE_ATTRIBUTES_LE)) 5450 5448 return -EACCES; ··· 5464 5462 } 5465 5463 5466 5464 if (file_info->ChangeTime) { 5467 5467 - temp_attrs.ia_ctime = ksmbd_NTtimeToUnix(file_info->ChangeTime); 5468 5468 - attrs.ia_ctime = temp_attrs.ia_ctime; 5465 5465 + attrs.ia_ctime = ksmbd_NTtimeToUnix(file_info->ChangeTime); 5466 5466 + ctime = attrs.ia_ctime; 5469 5467 attrs.ia_valid |= ATTR_CTIME; 5470 5468 } else { 5471 5471 - temp_attrs.ia_ctime = inode->i_ctime; 5469 5469 + ctime = inode->i_ctime; 5472 5470 } 5473 5471 5474 5472 if (file_info->LastWriteTime) { ··· 5507 5505 rc = 0; 5508 5506 } 5509 5507 5510 5510 - /* 5511 5511 - * HACK : set ctime here to avoid ctime changed 5512 5512 - * when file_info->ChangeTime is zero. 5513 5513 - */ 5514 5514 - attrs.ia_ctime = temp_attrs.ia_ctime; 5515 5515 - attrs.ia_valid |= ATTR_CTIME; 5516 5516 - 5517 5508 if (attrs.ia_valid) { 5518 5509 struct dentry *dentry = filp->f_path.dentry; 5519 5510 struct inode *inode = d_inode(dentry); ··· 5514 5519 if (IS_IMMUTABLE(inode) || IS_APPEND(inode)) 5515 5520 return -EACCES; 5516 5521 5517 5517 - rc = setattr_prepare(user_ns, dentry, &attrs); 5518 5518 - if (rc) 5519 5519 - return -EINVAL; 5520 5520 - 5521 5522 inode_lock(inode); 5522 5522 - setattr_copy(user_ns, inode, &attrs); 5523 5523 - attrs.ia_valid &= ~ATTR_CTIME; 5524 5523 rc = notify_change(user_ns, dentry, &attrs, NULL); 5524 5524 + if (!rc) { 5525 5525 + inode->i_ctime = ctime; 5526 5526 + mark_inode_dirty(inode); 5527 5527 + } 5525 5528 inode_unlock(inode); 5526 5529 } 5527 5527 - return 0; 5530 5530 + return rc; 5528 5531 } 5529 5532 5530 5533 static int set_file_allocation_info(struct ksmbd_work *work, ··· 5617 5624 static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp, 5618 5625 char *buf) 5619 5626 { 5627 5627 + struct user_namespace *user_ns; 5620 5628 struct ksmbd_file *parent_fp; 5621 5629 struct dentry *parent; 5622 5630 struct dentry *dentry = fp->filp->f_path.dentry; ··· 5628 5634 return -EACCES; 5629 5635 } 5630 5636 5637 5637 + user_ns = file_mnt_user_ns(fp->filp); 5631 5638 if (ksmbd_stream_fd(fp)) 5632 5639 goto next; 5633 5640 5634 5641 parent = dget_parent(dentry); 5635 5635 - ret = ksmbd_vfs_lock_parent(parent, dentry); 5642 5642 + ret = ksmbd_vfs_lock_parent(user_ns, parent, dentry); 5636 5643 if (ret) { 5637 5644 dput(parent); 5638 5645 return ret; ··· 5650 5655 } 5651 5656 } 5652 5657 next: 5653 5653 - return smb2_rename(work, fp, 5658 5658 + return smb2_rename(work, fp, user_ns, 5654 5659 (struct smb2_file_rename_info *)buf, 5655 5660 work->sess->conn->local_nls); 5656 5661 } ··· 7111 7116 netdev->ethtool_ops->get_link_ksettings(netdev, &cmd); 7112 7117 speed = cmd.base.speed; 7113 7118 } else { 7114 7114 - pr_err("%s %s\n", netdev->name, 7115 7115 - "speed is unknown, defaulting to 1Gb/sec"); 7119 7119 + ksmbd_debug(SMB, "%s %s\n", netdev->name, 7120 7120 + "speed is unknown, defaulting to 1Gb/sec"); 7116 7121 speed = SPEED_1000; 7117 7122 } 7118 7123

+1 -3

fs/ksmbd/smb_common.c

reviewed

··· 291 291 char *search_pattern, 292 292 int (*fn)(struct ksmbd_conn *, int, 293 293 struct ksmbd_dir_info *, 294 294 - struct user_namespace *, 295 294 struct ksmbd_kstat *)) 296 295 { 297 296 int i, rc = 0; ··· 321 322 user_ns, 322 323 dir->filp->f_path.dentry->d_parent, 323 324 &ksmbd_kstat); 324 324 - rc = fn(conn, info_level, d_info, 325 325 - user_ns, &ksmbd_kstat); 325 325 + rc = fn(conn, info_level, d_info, &ksmbd_kstat); 326 326 if (rc) 327 327 break; 328 328 if (d_info->out_buf_len <= 0)

-1

fs/ksmbd/smb_common.h

reviewed

··· 511 511 int (*fn)(struct ksmbd_conn *, 512 512 int, 513 513 struct ksmbd_dir_info *, 514 514 - struct user_namespace *, 515 514 struct ksmbd_kstat *)); 516 515 517 516 int ksmbd_extract_shortname(struct ksmbd_conn *conn,

+48 -31

fs/ksmbd/smbacl.c

reviewed

··· 274 274 uid_t id; 275 275 276 276 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]); 277 277 - if (id > 0) { 278 278 - uid = make_kuid(user_ns, id); 279 279 - if (uid_valid(uid) && kuid_has_mapping(user_ns, uid)) { 280 280 - fattr->cf_uid = uid; 281 281 - rc = 0; 282 282 - } 277 277 + /* 278 278 + * Translate raw sid into kuid in the server's user 279 279 + * namespace. 280 280 + */ 281 281 + uid = make_kuid(&init_user_ns, id); 282 282 + 283 283 + /* If this is an idmapped mount, apply the idmapping. */ 284 284 + uid = kuid_from_mnt(user_ns, uid); 285 285 + if (uid_valid(uid)) { 286 286 + fattr->cf_uid = uid; 287 287 + rc = 0; 283 288 } 284 289 } else { 285 290 kgid_t gid; 286 291 gid_t id; 287 292 288 293 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]); 289 289 - if (id > 0) { 290 290 - gid = make_kgid(user_ns, id); 291 291 - if (gid_valid(gid) && kgid_has_mapping(user_ns, gid)) { 292 292 - fattr->cf_gid = gid; 293 293 - rc = 0; 294 294 - } 294 294 + /* 295 295 + * Translate raw sid into kgid in the server's user 296 296 + * namespace. 297 297 + */ 298 298 + gid = make_kgid(&init_user_ns, id); 299 299 + 300 300 + /* If this is an idmapped mount, apply the idmapping. */ 301 301 + gid = kgid_from_mnt(user_ns, gid); 302 302 + if (gid_valid(gid)) { 303 303 + fattr->cf_gid = gid; 304 304 + rc = 0; 295 305 } 296 306 } 297 307 ··· 597 587 uid_t uid; 598 588 unsigned int sid_type = SIDOWNER; 599 589 600 600 - uid = from_kuid(user_ns, pace->e_uid); 590 590 + uid = posix_acl_uid_translate(user_ns, pace); 601 591 if (!uid) 602 592 sid_type = SIDUNIX_USER; 603 593 id_to_sid(uid, sid_type, sid); 604 594 } else if (pace->e_tag == ACL_GROUP) { 605 595 gid_t gid; 606 596 607 607 - gid = from_kgid(user_ns, pace->e_gid); 597 597 + gid = posix_acl_gid_translate(user_ns, pace); 608 598 id_to_sid(gid, SIDUNIX_GROUP, sid); 609 599 } else if (pace->e_tag == ACL_OTHER && !nt_aces_num) { 610 600 smb_copy_sid(sid, &sid_everyone); ··· 663 653 if (pace->e_tag == ACL_USER) { 664 654 uid_t uid; 665 655 666 666 - uid = from_kuid(user_ns, pace->e_uid); 656 656 + uid = posix_acl_uid_translate(user_ns, pace); 667 657 id_to_sid(uid, SIDCREATOR_OWNER, sid); 668 658 } else if (pace->e_tag == ACL_GROUP) { 669 659 gid_t gid; 670 660 671 671 - gid = from_kgid(user_ns, pace->e_gid); 661 661 + gid = posix_acl_gid_translate(user_ns, pace); 672 662 id_to_sid(gid, SIDCREATOR_GROUP, sid); 673 663 } else { 674 664 kfree(sid); ··· 733 723 } 734 724 735 725 /* owner RID */ 736 736 - uid = from_kuid(user_ns, fattr->cf_uid); 726 726 + uid = from_kuid(&init_user_ns, fattr->cf_uid); 737 727 if (uid) 738 728 sid = &server_conf.domain_sid; 739 729 else ··· 749 739 ace_size = fill_ace_for_sid(pace, &sid_unix_groups, 750 740 ACCESS_ALLOWED, 0, fattr->cf_mode, 0070); 751 741 pace->sid.sub_auth[pace->sid.num_subauth++] = 752 752 - cpu_to_le32(from_kgid(user_ns, fattr->cf_gid)); 742 742 + cpu_to_le32(from_kgid(&init_user_ns, fattr->cf_gid)); 753 743 pace->size = cpu_to_le16(ace_size + 4); 754 744 size += le16_to_cpu(pace->size); 755 745 pace = (struct smb_ace *)((char *)pndace + size); ··· 890 880 if (!nowner_sid_ptr) 891 881 return -ENOMEM; 892 882 893 893 - uid = from_kuid(user_ns, fattr->cf_uid); 883 883 + uid = from_kuid(&init_user_ns, fattr->cf_uid); 894 884 if (!uid) 895 885 sid_type = SIDUNIX_USER; 896 886 id_to_sid(uid, sid_type, nowner_sid_ptr); ··· 901 891 return -ENOMEM; 902 892 } 903 893 904 904 - gid = from_kgid(user_ns, fattr->cf_gid); 894 894 + gid = from_kgid(&init_user_ns, fattr->cf_gid); 905 895 id_to_sid(gid, SIDUNIX_GROUP, ngroup_sid_ptr); 906 896 907 897 offset = sizeof(struct smb_ntsd); ··· 1244 1234 pa_entry = posix_acls->a_entries; 1245 1235 for (i = 0; i < posix_acls->a_count; i++, pa_entry++) { 1246 1236 if (pa_entry->e_tag == ACL_USER) 1247 1247 - id = from_kuid(user_ns, 1248 1248 - pa_entry->e_uid); 1237 1237 + id = posix_acl_uid_translate(user_ns, pa_entry); 1249 1238 else if (pa_entry->e_tag == ACL_GROUP) 1250 1250 - id = from_kgid(user_ns, 1251 1251 - pa_entry->e_gid); 1239 1239 + id = posix_acl_gid_translate(user_ns, pa_entry); 1252 1240 else 1253 1241 continue; 1254 1242 ··· 1330 1322 newattrs.ia_valid |= ATTR_MODE; 1331 1323 newattrs.ia_mode = (inode->i_mode & ~0777) | (fattr.cf_mode & 0777); 1332 1324 1333 1333 - inode_lock(inode); 1334 1334 - rc = notify_change(user_ns, path->dentry, &newattrs, NULL); 1335 1335 - inode_unlock(inode); 1336 1336 - if (rc) 1337 1337 - goto out; 1338 1338 - 1339 1325 ksmbd_vfs_remove_acl_xattrs(user_ns, path->dentry); 1340 1326 /* Update posix acls */ 1341 1327 if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && fattr.cf_dacls) { 1342 1328 rc = set_posix_acl(user_ns, inode, 1343 1329 ACL_TYPE_ACCESS, fattr.cf_acls); 1344 1344 - if (S_ISDIR(inode->i_mode) && fattr.cf_dacls) 1330 1330 + if (rc < 0) 1331 1331 + ksmbd_debug(SMB, 1332 1332 + "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n", 1333 1333 + rc); 1334 1334 + if (S_ISDIR(inode->i_mode) && fattr.cf_dacls) { 1345 1335 rc = set_posix_acl(user_ns, inode, 1346 1336 ACL_TYPE_DEFAULT, fattr.cf_dacls); 1337 1337 + if (rc) 1338 1338 + ksmbd_debug(SMB, 1339 1339 + "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n", 1340 1340 + rc); 1341 1341 + } 1347 1342 } 1343 1343 + 1344 1344 + inode_lock(inode); 1345 1345 + rc = notify_change(user_ns, path->dentry, &newattrs, NULL); 1346 1346 + inode_unlock(inode); 1347 1347 + if (rc) 1348 1348 + goto out; 1348 1349 1349 1350 /* Check it only calling from SD BUFFER context */ 1350 1351 if (type_check && !(le16_to_cpu(pntsd->type) & DACL_PRESENT))

+25

fs/ksmbd/smbacl.h

reviewed

··· 209 209 bool type_check); 210 210 void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid); 211 211 void ksmbd_init_domain(u32 *sub_auth); 212 212 + 213 213 + static inline uid_t posix_acl_uid_translate(struct user_namespace *mnt_userns, 214 214 + struct posix_acl_entry *pace) 215 215 + { 216 216 + kuid_t kuid; 217 217 + 218 218 + /* If this is an idmapped mount, apply the idmapping. */ 219 219 + kuid = kuid_into_mnt(mnt_userns, pace->e_uid); 220 220 + 221 221 + /* Translate the kuid into a userspace id ksmbd would see. */ 222 222 + return from_kuid(&init_user_ns, kuid); 223 223 + } 224 224 + 225 225 + static inline gid_t posix_acl_gid_translate(struct user_namespace *mnt_userns, 226 226 + struct posix_acl_entry *pace) 227 227 + { 228 228 + kgid_t kgid; 229 229 + 230 230 + /* If this is an idmapped mount, apply the idmapping. */ 231 231 + kgid = kgid_into_mnt(mnt_userns, pace->e_gid); 232 232 + 233 233 + /* Translate the kgid into a userspace id ksmbd would see. */ 234 234 + return from_kgid(&init_user_ns, kgid); 235 235 + } 236 236 + 212 237 #endif /* _SMBACL_H */

+1 -1

fs/ksmbd/transport_rdma.c

reviewed

··· 1168 1168 pr_err("failed to map buffer\n"); 1169 1169 ret = -ENOMEM; 1170 1170 goto err; 1171 1171 - } else if (sg_cnt + msg->num_sge > SMB_DIRECT_MAX_SEND_SGES - 1) { 1171 1171 + } else if (sg_cnt + msg->num_sge > SMB_DIRECT_MAX_SEND_SGES) { 1172 1172 pr_err("buffer not fitted into sges\n"); 1173 1173 ret = -E2BIG; 1174 1174 ib_dma_unmap_sg(t->cm_id->device, sg, sg_cnt,

+26 -21

fs/ksmbd/vfs.c

reviewed

··· 69 69 * 70 70 * the reference count of @parent isn't incremented. 71 71 */ 72 72 - int ksmbd_vfs_lock_parent(struct dentry *parent, struct dentry *child) 72 72 + int ksmbd_vfs_lock_parent(struct user_namespace *user_ns, struct dentry *parent, 73 73 + struct dentry *child) 73 74 { 74 75 struct dentry *dentry; 75 76 int ret = 0; 76 77 77 78 inode_lock_nested(d_inode(parent), I_MUTEX_PARENT); 78 78 - dentry = lookup_one_len(child->d_name.name, parent, 79 79 - child->d_name.len); 79 79 + dentry = lookup_one(user_ns, child->d_name.name, parent, 80 80 + child->d_name.len); 80 81 if (IS_ERR(dentry)) { 81 82 ret = PTR_ERR(dentry); 82 83 goto out_err; ··· 103 102 int ret; 104 103 105 104 parent = dget_parent(dentry); 106 106 - ret = ksmbd_vfs_lock_parent(parent, dentry); 105 105 + ret = ksmbd_vfs_lock_parent(user_ns, parent, dentry); 107 106 if (ret) { 108 107 dput(parent); 109 108 return ret; ··· 138 137 *daccess |= FILE_EXECUTE_LE; 139 138 140 139 parent = dget_parent(dentry); 141 141 - ret = ksmbd_vfs_lock_parent(parent, dentry); 140 140 + ret = ksmbd_vfs_lock_parent(user_ns, parent, dentry); 142 141 if (ret) { 143 142 dput(parent); 144 143 return ret; ··· 198 197 */ 199 198 int ksmbd_vfs_mkdir(struct ksmbd_work *work, const char *name, umode_t mode) 200 199 { 200 200 + struct user_namespace *user_ns; 201 201 struct path path; 202 202 struct dentry *dentry; 203 203 int err; ··· 212 210 return err; 213 211 } 214 212 213 213 + user_ns = mnt_user_ns(path.mnt); 215 214 mode |= S_IFDIR; 216 216 - err = vfs_mkdir(mnt_user_ns(path.mnt), d_inode(path.dentry), 217 217 - dentry, mode); 215 215 + err = vfs_mkdir(user_ns, d_inode(path.dentry), dentry, mode); 218 216 if (err) { 219 217 goto out; 220 218 } else if (d_unhashed(dentry)) { 221 219 struct dentry *d; 222 220 223 223 - d = lookup_one_len(dentry->d_name.name, dentry->d_parent, 224 224 - dentry->d_name.len); 221 221 + d = lookup_one(user_ns, dentry->d_name.name, dentry->d_parent, 222 222 + dentry->d_name.len); 225 223 if (IS_ERR(d)) { 226 224 err = PTR_ERR(d); 227 225 goto out; ··· 584 582 */ 585 583 int ksmbd_vfs_remove_file(struct ksmbd_work *work, char *name) 586 584 { 585 585 + struct user_namespace *user_ns; 587 586 struct path path; 588 587 struct dentry *parent; 589 588 int err; ··· 604 601 return err; 605 602 } 606 603 604 604 + user_ns = mnt_user_ns(path.mnt); 607 605 parent = dget_parent(path.dentry); 608 608 - err = ksmbd_vfs_lock_parent(parent, path.dentry); 606 606 + err = ksmbd_vfs_lock_parent(user_ns, parent, path.dentry); 609 607 if (err) { 610 608 dput(parent); 611 609 path_put(&path); ··· 620 616 } 621 617 622 618 if (S_ISDIR(d_inode(path.dentry)->i_mode)) { 623 623 - err = vfs_rmdir(mnt_user_ns(path.mnt), d_inode(parent), 624 624 - path.dentry); 619 619 + err = vfs_rmdir(user_ns, d_inode(parent), path.dentry); 625 620 if (err && err != -ENOTEMPTY) 626 621 ksmbd_debug(VFS, "%s: rmdir failed, err %d\n", name, 627 622 err); 628 623 } else { 629 629 - err = vfs_unlink(mnt_user_ns(path.mnt), d_inode(parent), 630 630 - path.dentry, NULL); 624 624 + err = vfs_unlink(user_ns, d_inode(parent), path.dentry, NULL); 631 625 if (err) 632 626 ksmbd_debug(VFS, "%s: unlink failed, err %d\n", name, 633 627 err); ··· 750 748 if (ksmbd_override_fsids(work)) 751 749 return -ENOMEM; 752 750 753 753 - dst_dent = lookup_one_len(dst_name, dst_dent_parent, strlen(dst_name)); 751 751 + dst_dent = lookup_one(dst_user_ns, dst_name, dst_dent_parent, 752 752 + strlen(dst_name)); 754 753 err = PTR_ERR(dst_dent); 755 754 if (IS_ERR(dst_dent)) { 756 755 pr_err("lookup failed %s [%d]\n", dst_name, err); ··· 782 779 int ksmbd_vfs_fp_rename(struct ksmbd_work *work, struct ksmbd_file *fp, 783 780 char *newname) 784 781 { 782 782 + struct user_namespace *user_ns; 785 783 struct path dst_path; 786 784 struct dentry *src_dent_parent, *dst_dent_parent; 787 785 struct dentry *src_dent, *trap_dent, *src_child; ··· 812 808 trap_dent = lock_rename(src_dent_parent, dst_dent_parent); 813 809 dget(src_dent); 814 810 dget(dst_dent_parent); 815 815 - src_child = lookup_one_len(src_dent->d_name.name, src_dent_parent, 816 816 - src_dent->d_name.len); 811 811 + user_ns = file_mnt_user_ns(fp->filp); 812 812 + src_child = lookup_one(user_ns, src_dent->d_name.name, src_dent_parent, 813 813 + src_dent->d_name.len); 817 814 if (IS_ERR(src_child)) { 818 815 err = PTR_ERR(src_child); 819 816 goto out_lock; ··· 828 823 dput(src_child); 829 824 830 825 err = __ksmbd_vfs_rename(work, 831 831 - file_mnt_user_ns(fp->filp), 826 826 + user_ns, 832 827 src_dent_parent, 833 828 src_dent, 834 829 mnt_user_ns(dst_path.mnt), ··· 1114 1109 { 1115 1110 int err = 0; 1116 1111 1117 1117 - err = ksmbd_vfs_lock_parent(dir, dentry); 1112 1112 + err = ksmbd_vfs_lock_parent(user_ns, dir, dentry); 1118 1113 if (err) 1119 1114 return err; 1120 1115 dget(dentry); ··· 1390 1385 switch (pa_entry->e_tag) { 1391 1386 case ACL_USER: 1392 1387 xa_entry->type = SMB_ACL_USER; 1393 1393 - xa_entry->uid = from_kuid(user_ns, pa_entry->e_uid); 1388 1388 + xa_entry->uid = posix_acl_uid_translate(user_ns, pa_entry); 1394 1389 break; 1395 1390 case ACL_USER_OBJ: 1396 1391 xa_entry->type = SMB_ACL_USER_OBJ; 1397 1392 break; 1398 1393 case ACL_GROUP: 1399 1394 xa_entry->type = SMB_ACL_GROUP; 1400 1400 - xa_entry->gid = from_kgid(user_ns, pa_entry->e_gid); 1395 1395 + xa_entry->gid = posix_acl_gid_translate(user_ns, pa_entry); 1401 1396 break; 1402 1397 case ACL_GROUP_OBJ: 1403 1398 xa_entry->type = SMB_ACL_GROUP_OBJ;

+2 -1

fs/ksmbd/vfs.h

reviewed

··· 107 107 __le32 file_attributes; 108 108 }; 109 109 110 110 - int ksmbd_vfs_lock_parent(struct dentry *parent, struct dentry *child); 110 110 + int ksmbd_vfs_lock_parent(struct user_namespace *user_ns, struct dentry *parent, 111 111 + struct dentry *child); 111 112 int ksmbd_vfs_may_delete(struct user_namespace *user_ns, struct dentry *dentry); 112 113 int ksmbd_vfs_query_maximal_access(struct user_namespace *user_ns, 113 114 struct dentry *dentry, __le32 *daccess);

-16

fs/ksmbd/vfs_cache.c

reviewed

··· 666 666 ksmbd_destroy_file_table(&global_ft); 667 667 } 668 668 669 669 - int ksmbd_file_table_flush(struct ksmbd_work *work) 670 670 - { 671 671 - struct ksmbd_file *fp = NULL; 672 672 - unsigned int id; 673 673 - int ret; 674 674 - 675 675 - read_lock(&work->sess->file_table.lock); 676 676 - idr_for_each_entry(work->sess->file_table.idr, fp, id) { 677 677 - ret = ksmbd_vfs_fsync(work, fp->volatile_id, KSMBD_NO_FID); 678 678 - if (ret) 679 679 - break; 680 680 - } 681 681 - read_unlock(&work->sess->file_table.lock); 682 682 - return ret; 683 683 - } 684 684 - 685 669 int ksmbd_init_file_table(struct ksmbd_file_table *ft) 686 670 { 687 671 ft->idr = kzalloc(sizeof(struct idr), GFP_KERNEL);

-1

fs/ksmbd/vfs_cache.h

reviewed

··· 152 152 int ksmbd_close_inode_fds(struct ksmbd_work *work, struct inode *inode); 153 153 int ksmbd_init_global_file_table(void); 154 154 void ksmbd_free_global_file_table(void); 155 155 - int ksmbd_file_table_flush(struct ksmbd_work *work); 156 155 void ksmbd_set_fd_limit(unsigned long limit); 157 156 158 157 /*