FAILED: patch "[PATCH] smb: client: avoid using uninitialized SIDs in" failed to apply to 6.1-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x da6e25842431982d5a53cf00d925b98c690f4467
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091629-whiny-coveted-cab9@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From da6e25842431982d5a53cf00d925b98c690f4467 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <[email protected]>
Date: Sun, 6 Sep 2026 14:40:39 -0300
Subject: [PATCH] smb: client: avoid using uninitialized SIDs in
cifs_posix_to_fattr()
cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to request_key() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon.
Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected.
fs/smb/client/readdir.c +11 -5
@@ -244,8 +244,9 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, {unsigned int sbflags =cifs_sb_flags (cifs_sb);struct smb2_posix_info_parsed parsed; +int rc; -posix_info_parse (info,NULL , &parsed); + rc =posix_info_parse (info,NULL , &parsed);memset (fattr,0 ,sizeof (*fattr)); fattr->cf_uniqueid =le64_to_cpu (info->Inode);
@@ -284,10 +285,15 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, fattr->cf_uid = cifs_sb->ctx->linux_uid; fattr->cf_gid = cifs_sb->ctx->linux_gid; -if (!(sbflags &CIFS_MOUNT_OVERR_UID )) -sid_to_id (cifs_sb, &parsed.owner, fattr,SIDOWNER ); -if (!(sbflags &CIFS_MOUNT_OVERR_GID )) -sid_to_id (cifs_sb, &parsed.group, fattr,SIDGROUP ); +if (rc <0 ) { +cifs_dbg (VFS ,"%s: failed to parse SIDs: %d\n" , + __func__, rc); + }else { +if (!(sbflags &CIFS_MOUNT_OVERR_UID )) +sid_to_id (cifs_sb, &parsed.owner, fattr,SIDOWNER ); +if (!(sbflags &CIFS_MOUNT_OVERR_GID )) +sid_to_id (cifs_sb, &parsed.group, fattr,SIDGROUP ); + } }static void __dir_info_to_fattr (struct cifs_fattr *fattr,const void *info)
Sasha Levin
maintainerPATCH 1/2 smb: client: use atomic_t for mnt_cifs_flags
From: Paulo Alcantara <[email protected]>
[ Upstream commit 4fc3a433c13944ee5766ec5b9bf6f1eb4d29b880 ]
Use atomic_t for cifs_sb_info::mnt_cifs_flags as it's currently accessed locklessly and may be changed concurrently in mount/remount and reconnect paths.
Backport to 6.1 as a dependency of da6e258424319 (smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()):
Keep the stable CIFS_SB/CIFS_FILE_SB interfaces, cifs_remap(), cifs_forced_shutdown(), and smb3_update_mnt_flags() signatures. Use a single-evaluation cifs_sb_flags macro instead of adding helper functions. Convert all mount flag readers and writers present in this tree, including legacy reconnect and DFS paths absent from the upstream patch. Publish remount flags with atomic_set() and use atomic bit operations for the remaining updates. Drop hunks for missing reparse and newer helper code.
Fold in only the cifs_posix_to_fattr() prerequisite from 18a72975e9f35 (smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid): take the flag snapshot, initialize ownership from the mount defaults, and honor the UID/GID overrides. This supplies the exact context and fallback ownership required by da6e258424319, which is left for the caller to apply. No new functions are introduced.
[ sashal: Reduced backport -- upstream 4fc3a433c1394 touches 27 file(s), this
backport carries 23. Not backported here:
fs/smb/client/cifs_unicode.h
fs/smb/client/fs_context.h
fs/smb/client/reparse.c
fs/smb/client/reparse.h
fs/smb/client/smb2file.c
This note is generated from the file lists only; see the resolution record for the reasoning. ]
Stable-dep-of: da6e25842431 ("smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()")
--- fs/smb/client/cached_dir.c | 2 +- fs/smb/client/cifs_dfs_ref.c | 2 +- fs/smb/client/cifs_fs_sb.h | 8 ++- fs/smb/client/cifs_ioctl.h | 2 +- fs/smb/client/cifs_unicode.c | 4 +- fs/smb/client/cifsacl.c | 6 +- fs/smb/client/cifsfs.c | 66 ++++++++++----------- fs/smb/client/cifsglob.h | 10 +++- fs/smb/client/connect.c | 45 +++++++------- fs/smb/client/dfs_cache.c | 2 +- fs/smb/client/dir.c | 16 ++--- fs/smb/client/file.c | 38 ++++++------ fs/smb/client/fs_context.c | 110 +++++++++++++++++------------------ fs/smb/client/inode.c | 88 ++++++++++++++-------------- fs/smb/client/ioctl.c | 2 +- fs/smb/client/link.c | 2 +- fs/smb/client/misc.c | 12 ++-- fs/smb/client/readdir.c | 27 +++++---- fs/smb/client/smb1ops.c | 4 +- fs/smb/client/smb2misc.c | 4 +- fs/smb/client/smb2ops.c | 4 +- fs/smb/client/smb2pdu.c | 4 +- fs/smb/client/xattr.c | 6 +- 23 files changed, 240 insertions(+), 224 deletions(-)
fs/smb/client/cached_dir.c +1 -1
@@ -107,7 +107,7 @@ static const char *path_no_prefix(struct cifs_sb_info *cifs_sb,if (!*path)return path; -if ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_USE_PREFIX_PATH ) && +if ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_USE_PREFIX_PATH ) && cifs_sb->prepath) { len =strlen (cifs_sb->prepath) +1 ;if (unlikely (len >strlen (path)))
fs/smb/client/cifs_dfs_ref.c +1 -1
@@ -323,7 +323,7 @@ static struct vfsmount *cifs_dfs_do_automount(struct path *path)* gives us the latter, so we must adjust the result. */ cifs_sb =CIFS_SB (mntpt->d_sb); -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_DFS ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NO_DFS )return ERR_PTR (-EREMOTE ); cur_ctx = cifs_sb->ctx;
fs/smb/client/cifs_fs_sb.h +7 -1
@@ -10,6 +10,7 @@#ifndef _CIFS_FS_SB_H#define _CIFS_FS_SB_H +#include <linux/atomic.h> #include <linux/backing-dev.h> #define CIFS_MOUNT_NO_PERM 1/* do not do client vfs_perm check */
@@ -54,7 +55,7 @@ struct cifs_sb_info {struct nls_table *local_nls;struct smb3_fs_context *ctx;atomic_t active; -unsigned int mnt_cifs_flags; +atomic_t mnt_cifs_flags;struct delayed_work prune_tlinks;struct rcu_head rcu;
@@ -73,4 +74,9 @@ struct cifs_sb_info {*/ struct dentry *root; }; + +/* Mount flags are shared by mount/remount and reconnect paths. */ +#define cifs_sb_flags (cifs_sb) \ + ((unsigned int)atomic_read(&(cifs_sb)->mnt_cifs_flags)) +#endif /* _CIFS_FS_SB_H */
fs/smb/client/cifs_ioctl.h +1 -1
@@ -125,7 +125,7 @@ struct smb3_notify_info {static inline bool cifs_forced_shutdown (struct cifs_sb_info *sbi) { -if (CIFS_MOUNT_SHUTDOWN & sbi->mnt_cifs_flags) +if (CIFS_MOUNT_SHUTDOWN &cifs_sb_flags (sbi))return true;else return false;
fs/smb/client/cifs_unicode.c +2 -2
@@ -17,9 +17,9 @@ int cifs_remap(struct cifs_sb_info *cifs_sb) {int map_type; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MAP_SFM_CHR ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MAP_SFM_CHR ) map_type =SFM_MAP_UNI_RSVD ; -else if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MAP_SPECIAL_CHR ) +else if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MAP_SPECIAL_CHR ) map_type =SFU_MAP_UNI_RSVD ;else map_type =NO_MAP_UNI_RSVD ;
fs/smb/client/cifsacl.c +3 -3
@@ -351,7 +351,7 @@ sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,return -EIO ; } -if ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UID_FROM_ACL ) || +if ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_UID_FROM_ACL ) || (cifs_sb_master_tcon (cifs_sb)->posix_extensions)) {uint32_t unix_id;bool is_group;
@@ -1698,12 +1698,12 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,return rc; } -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MODE_FROM_SID ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MODE_FROM_SID ) mode_from_sid = true;else mode_from_sid = false; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UID_FROM_ACL ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_UID_FROM_ACL ) id_from_sid = true;else id_from_sid = false;
fs/smb/client/cifsfs.c +33 -33
148 lines not on this page · raw message
fs/smb/client/cifsglob.h +7 -3
@@ -1468,9 +1468,13 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);#define CIFS_CACHE_RW_FLG (CIFS_CACHE_READ_FLG | CIFS_CACHE_WRITE_FLG)#define CIFS_CACHE_RHW_FLG (CIFS_CACHE_RW_FLG | CIFS_CACHE_HANDLE_FLG) -#define CIFS_CACHE_READ (cinode) ((cinode->oplock & CIFS_CACHE_READ_FLG) || (CIFS_SB(cinode->netfs.inode.i_sb)->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE)) +#define CIFS_CACHE_READ (cinode) \ + (((cinode)->oplock & CIFS_CACHE_READ_FLG) || \ + (cifs_sb_flags(CIFS_SB((cinode)->netfs.inode.i_sb)) & CIFS_MOUNT_RO_CACHE))#define CIFS_CACHE_HANDLE (cinode) (cinode->oplock & CIFS_CACHE_HANDLE_FLG) -#define CIFS_CACHE_WRITE (cinode) ((cinode->oplock & CIFS_CACHE_WRITE_FLG) || (CIFS_SB(cinode->netfs.inode.i_sb)->mnt_cifs_flags & CIFS_MOUNT_RW_CACHE)) +#define CIFS_CACHE_WRITE (cinode) \ + (((cinode)->oplock & CIFS_CACHE_WRITE_FLG) || \ + (cifs_sb_flags(CIFS_SB((cinode)->netfs.inode.i_sb)) & CIFS_MOUNT_RW_CACHE))/* * One of these for each file inode
@@ -1534,7 +1538,7 @@ CIFS_FILE_SB(struct file *file)static inline char CIFS_DIR_SEP (const struct cifs_sb_info *cifs_sb) { -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_POSIX_PATHS ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_POSIX_PATHS )return '/' ;else return '\\' ;
fs/smb/client/connect.c +23 -22
141 lines not on this page · raw message
fs/smb/client/dfs_cache.c +1 -1
@@ -1527,7 +1527,7 @@ int dfs_cache_remount_fs(struct cifs_sb_info *cifs_sb)* Force the use of prefix path to support failover on DFS paths that resolve to targets * that have different prefix paths. */ - cifs_sb->mnt_cifs_flags |=CIFS_MOUNT_USE_PREFIX_PATH ; +atomic_or (CIFS_MOUNT_USE_PREFIX_PATH , &cifs_sb->mnt_cifs_flags); rc =refresh_tcon (sessions, tcon, true);kref_put (&mg->refcount, mount_group_release);
fs/smb/client/dir.c +8 -8
@@ -96,7 +96,7 @@ char *__build_path_from_dentry_optional_prefix(struct dentry *direntry, void *paelse dfsplen =0 ; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_USE_PREFIX_PATH ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_USE_PREFIX_PATH ) pplen = cifs_sb->prepath ?strlen (cifs_sb->prepath) +1 :0 ; s =dentry_path_raw (direntry, page,PATH_MAX );
@@ -123,7 +123,7 @@ char *__build_path_from_dentry_optional_prefix(struct dentry *direntry, void *paif (dfsplen) { s -= dfsplen;memcpy (s, tree, dfsplen); -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_POSIX_PATHS ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_POSIX_PATHS ) {int i;for (i =0 ; i < dfsplen; i++) {if (s[i] =='\\' )
@@ -160,7 +160,7 @@ check_name(struct dentry *direntry, struct cifs_tcon *tcon) le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength)))return -ENAMETOOLONG ; -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_POSIX_PATHS )) { +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_POSIX_PATHS )) {for (i =0 ; i < direntry->d_name.len; i++) {if (direntry->d_name.name[i] =='\\' ) {cifs_dbg (FYI ,"Invalid file name\n" );
@@ -350,7 +350,7 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned .device = 0, }; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_SET_UID ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_SET_UID ) { args.uid =current_fsuid ();if (inode->i_mode &S_ISGID ) args.gid = inode->i_gid;
@@ -387,9 +387,9 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsignedif (server->ops->set_lease_key) server->ops->set_lease_key (newinode, fid);if ((*oplock &CIFS_CREATE_ACTION ) &&S_ISREG (newinode->i_mode)) { -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_DYNPERM ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_DYNPERM ) newinode->i_mode = mode; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_SET_UID ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_SET_UID ) { newinode->i_uid =current_fsuid ();if (inode->i_mode &S_ISGID ) newinode->i_gid = inode->i_gid;
@@ -519,8 +519,8 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, }if (file->f_flags &O_DIRECT && -CIFS_SB (inode->i_sb)->mnt_cifs_flags &CIFS_MOUNT_STRICT_IO ) { -if (CIFS_SB (inode->i_sb)->mnt_cifs_flags &CIFS_MOUNT_NO_BRL ) +cifs_sb_flags (CIFS_SB (inode->i_sb)) &CIFS_MOUNT_STRICT_IO ) { +if (cifs_sb_flags (CIFS_SB (inode->i_sb)) &CIFS_MOUNT_NO_BRL ) file->f_op = &cifs_file_direct_nobrl_ops;else file->f_op = &cifs_file_direct_ops;
fs/smb/client/file.c +19 -19
@@ -566,7 +566,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file,* close because it may cause a error when we open this file * again and get at least level II oplock. */ -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_STRICT_IO ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_STRICT_IO )set_bit (CIFS_INO_INVALID_MAPPING , &cifsi->flags);cifs_set_oplock_level (cifsi,0 ); }
@@ -657,8 +657,8 @@ int cifs_open(struct inode *inode, struct file *file) inode, file->f_flags, full_path);if (file->f_flags &O_DIRECT && - cifs_sb->mnt_cifs_flags &CIFS_MOUNT_STRICT_IO ) { -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_BRL ) +cifs_sb_flags (cifs_sb) &CIFS_MOUNT_STRICT_IO ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NO_BRL ) file->f_op = &cifs_file_direct_nobrl_ops;else file->f_op = &cifs_file_direct_ops;
@@ -806,7 +806,7 @@ cifs_relock_file(struct cifsFileInfo *cfile)#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY if (cap_unix (tcon->ses) && (CIFS_UNIX_FCNTL_CAP &le64_to_cpu (tcon->fsUnixInfo.Capability)) && - ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) + ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) rc =cifs_push_posix_locks (cfile); else#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
@@ -1587,7 +1587,7 @@ cifs_push_locks(struct cifsFileInfo *cfile)#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY if (cap_unix (tcon->ses) && (CIFS_UNIX_FCNTL_CAP &le64_to_cpu (tcon->fsUnixInfo.Capability)) && - ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) + ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) rc =cifs_push_posix_locks (cfile); else#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
@@ -1996,7 +1996,7 @@ int cifs_flock(struct file *file, int cmd, struct file_lock *fl)if (cap_unix (tcon->ses) && (CIFS_UNIX_FCNTL_CAP &le64_to_cpu (tcon->fsUnixInfo.Capability)) && - ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) + ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) posix_lck = true;if (!lock && !unlock) {
@@ -2045,7 +2045,7 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *flock)if (cap_unix (tcon->ses) && (CIFS_UNIX_FCNTL_CAP &le64_to_cpu (tcon->fsUnixInfo.Capability)) && - ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) + ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) posix_lck = true;/* * BB add code here to normalize offset and length to account for
@@ -2177,7 +2177,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,struct cifs_sb_info *cifs_sb =CIFS_SB (cifs_inode->netfs.inode.i_sb);/* only filter by fsuid on multiuser mounts */ -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MULTIUSER )) +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MULTIUSER )) fsuid_only = false;spin_lock (&cifs_inode->open_file_lock);
@@ -2233,7 +2233,7 @@ cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, int flags, cifs_sb =CIFS_SB (cifs_inode->netfs.inode.i_sb);/* only filter by fsuid on multiuser mounts */ -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MULTIUSER )) +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MULTIUSER )) fsuid_only = false;spin_lock (&cifs_inode->open_file_lock);
@@ -2963,7 +2963,7 @@ static int cifs_write_end(struct file *file, struct address_space *mapping,struct cifs_sb_info *cifs_sb =CIFS_SB (cfile->dentry->d_sb);__u32 pid; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_RWPIDFORWARD ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_RWPIDFORWARD ) pid = cfile->pid;else pid = current->tgid;
@@ -3049,7 +3049,7 @@ int cifs_strict_fsync(struct file *file, loff_t start, loff_t end, } tcon =tlink_tcon (smbfile->tlink); -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOSSYNC )) { +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOSSYNC )) { server = tcon->ses->server;if (server->ops->flush ==NULL ) { rc = -ENOSYS ;
@@ -3094,7 +3094,7 @@ int cifs_fsync(struct file *file, loff_t start, loff_t end, int datasync) file, datasync); tcon =tlink_tcon (smbfile->tlink); -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOSSYNC )) { +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOSSYNC )) { server = tcon->ses->server;if (server->ops->flush ==NULL ) { rc = -ENOSYS ;
@@ -3344,7 +3344,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,size_t start;unsigned int xid; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_RWPIDFORWARD ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_RWPIDFORWARD ) pid = open_file->pid;else pid = current->tgid;
@@ -3747,7 +3747,7 @@ cifs_strict_writev(struct kiocb *iocb, struct iov_iter *from)if (CIFS_CACHE_WRITE (cinode)) {if (cap_unix (tcon->ses) && (CIFS_UNIX_FCNTL_CAP &le64_to_cpu (tcon->fsUnixInfo.Capability)) - && ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) { + && ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) { written =generic_file_write_iter (iocb, from); goto out; }
@@ -4084,7 +4084,7 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file, server =cifs_pick_channel (tlink_tcon (open_file->tlink)->ses); -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_RWPIDFORWARD ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_RWPIDFORWARD ) pid = open_file->pid;else pid = current->tgid;
@@ -4462,7 +4462,7 @@ cifs_strict_readv(struct kiocb *iocb, struct iov_iter *to)if (cap_unix (tcon->ses) && (CIFS_UNIX_FCNTL_CAP &le64_to_cpu (tcon->fsUnixInfo.Capability)) && - ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NOPOSIXBRL ) ==0 )) + ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NOPOSIXBRL ) ==0 ))return generic_file_read_iter (iocb, to);/*
@@ -4516,7 +4516,7 @@ cifs_read(struct file *file, char *read_data, size_t read_size, loff_t *offset)return -ENOSYS ; } -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_RWPIDFORWARD ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_RWPIDFORWARD ) pid = open_file->pid;else pid = current->tgid;
@@ -4784,7 +4784,7 @@ static void cifs_readahead(struct readahead_control *ractl) xid =get_xid (); -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_RWPIDFORWARD ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_RWPIDFORWARD ) pid = open_file->pid;else pid = current->tgid;
@@ -5037,7 +5037,7 @@ bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file)struct cifs_sb_info *cifs_sb; cifs_sb =CIFS_SB (cifsInode->netfs.inode.i_sb); -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_DIRECT_IO ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_DIRECT_IO ) {/* since no page cache to corrupt on directio we can change size safely */ return true;
fs/smb/client/fs_context.c +55 -55
201 lines not on this page · raw message
fs/smb/client/inode.c +44 -44
296 lines not on this page · raw message
fs/smb/client/ioctl.c +1 -1
@@ -208,7 +208,7 @@ static int cifs_shutdown(struct super_block *sb, unsigned long arg)*/ case CIFS_GOING_FLAGS_LOGFLUSH :case CIFS_GOING_FLAGS_NOLOGFLUSH : - sbi->mnt_cifs_flags |=CIFS_MOUNT_SHUTDOWN ; +atomic_or (CIFS_MOUNT_SHUTDOWN , &sbi->mnt_cifs_flags);return 0 ;default :return -EINVAL ;
fs/smb/client/link.c +1 -1
@@ -613,7 +613,7 @@ cifs_symlink(struct user_namespace *mnt_userns, struct inode *inode,cifs_dbg (FYI ,"symname is %s\n" , symname);/* BB what if DFS and this volume is on different share? BB */ -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MF_SYMLINKS ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MF_SYMLINKS ) rc =create_mf_symlink (xid, pTcon, cifs_sb, full_path, symname);#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY else if (pTcon->unix_ext)
fs/smb/client/misc.c +6 -6
@@ -547,13 +547,13 @@ dump_smb(void *buf, int smb_buf_length)void cifs_autodisable_serverino (struct cifs_sb_info *cifs_sb) { -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_SERVER_INUM ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_SERVER_INUM ) {struct cifs_tcon *tcon =NULL ;if (cifs_sb->master_tlink) tcon =cifs_sb_master_tcon (cifs_sb); - cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM ; +atomic_andnot (CIFS_MOUNT_SERVER_INUM , &cifs_sb->mnt_cifs_flags); cifs_sb->mnt_cifs_serverino_autodisabled = true;cifs_dbg (VFS ,"Autodisabling the use of server inode numbers on %s\n" , tcon ? tcon->tree_name :"new server" );
@@ -654,11 +654,11 @@ void cifs_done_oplock_break(struct cifsInodeInfo *cinode)bool backup_cred (struct cifs_sb_info *cifs_sb) { -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_CIFS_BACKUPUID ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_CIFS_BACKUPUID ) {if (uid_eq (cifs_sb->ctx->backupuid,current_fsuid ()))return true; } -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_CIFS_BACKUPGID ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_CIFS_BACKUPGID ) {if (in_group_p (cifs_sb->ctx->backupgid))return true; }
@@ -1421,7 +1421,7 @@ int cifs_update_super_prepath(struct cifs_sb_info *cifs_sb, char *prefix) }else cifs_sb->prepath =NULL ; - cifs_sb->mnt_cifs_flags |=CIFS_MOUNT_USE_PREFIX_PATH ; +atomic_or (CIFS_MOUNT_USE_PREFIX_PATH , &cifs_sb->mnt_cifs_flags);return 0 ; }
@@ -1449,7 +1449,7 @@ int cifs_inval_name_dfs_link_error(const unsigned int xid,* look up or tcon is not DFS. */ if (strlen (full_path) <2 || !cifs_sb || - (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_DFS ) || + (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NO_DFS ) || !is_tcon_dfs (tcon) || !ses->server->origin_fullpath)return 0 ;
fs/smb/client/readdir.c +16 -11
@@ -101,7 +101,7 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name,* want to clobber the existing one with the one that * the readdir code created. */ -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_SERVER_INUM )) +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_SERVER_INUM )) fattr->cf_uniqueid =CIFS_I (inode)->uniqueid;/* update inode in place
@@ -207,11 +207,11 @@ cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb)* may look wrong since the inodes may not have timed out by the time * "ls" does a stat() call on them. */ -if ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_CIFS_ACL ) || - (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MODE_FROM_SID )) +if ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_CIFS_ACL ) || + (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MODE_FROM_SID )) fattr->cf_flags |=CIFS_FATTR_NEED_REVAL ; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UNX_EMUL && +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_UNX_EMUL && fattr->cf_cifsattrs &ATTR_SYSTEM ) {if (fattr->cf_eof ==0 ) { fattr->cf_mode &= ~S_IFMT ;
@@ -233,6 +233,7 @@ static void cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, struct cifs_sb_info *cifs_sb) { + unsigned int sbflags = cifs_sb_flags(cifs_sb);struct smb2_posix_info_parsed parsed;posix_info_parse (info,NULL , &parsed);
@@ -277,8 +278,12 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info,if (reparse_file_needs_reval (fattr)) fattr->cf_flags |=CIFS_FATTR_NEED_REVAL ; -sid_to_id (cifs_sb, &parsed.owner, fattr,SIDOWNER ); -sid_to_id (cifs_sb, &parsed.group, fattr,SIDGROUP ); + fattr->cf_uid = cifs_sb->ctx->linux_uid; + fattr->cf_gid = cifs_sb->ctx->linux_gid; +if (!(sbflags &CIFS_MOUNT_OVERR_UID )) +sid_to_id (cifs_sb, &parsed.owner, fattr,SIDOWNER ); +if (!(sbflags &CIFS_MOUNT_OVERR_GID )) +sid_to_id (cifs_sb, &parsed.group, fattr,SIDGROUP ); }static void __dir_info_to_fattr (struct cifs_fattr *fattr,const void *info)
@@ -424,7 +429,7 @@ _initiate_cifs_search(const unsigned int xid, struct file *file,else if ((tcon->ses->capabilities & tcon->ses->server->vals->cap_nt_find) ==0 ) { cifsFile->srch_inf.info_level =SMB_FIND_FILE_INFO_STANDARD ; - }else if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_SERVER_INUM ) { + }else if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_SERVER_INUM ) { cifsFile->srch_inf.info_level =SMB_FIND_FILE_ID_FULL_DIR_INFO ; }else /* not srvinos - BB fixme add check for backlevel? */ { cifsFile->srch_inf.info_level =SMB_FIND_FILE_FULL_DIRECTORY_INFO ;
@@ -444,8 +449,8 @@ _initiate_cifs_search(const unsigned int xid, struct file *file,else if STATUS_STOPPED_ON_SYMLINK call get_symlink_reparse_path and retry with new path */ else if ((rc == -EOPNOTSUPP) && - (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) { - cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM ; + (cifs_sb_flags(cifs_sb) & CIFS_MOUNT_SERVER_INUM)) { +atomic_andnot (CIFS_MOUNT_SERVER_INUM , &cifs_sb->mnt_cifs_flags); goto ffirst_retry; } error_exit:
@@ -1037,14 +1042,14 @@ static int cifs_filldir(char *find_entry, struct file *file,break ; } -if (de.ino && (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_SERVER_INUM )) { +if (de.ino && (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_SERVER_INUM )) { fattr.cf_uniqueid = de.ino; }else { fattr.cf_uniqueid =iunique (sb,ROOT_I );cifs_autodisable_serverino (cifs_sb); } -if ((cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MF_SYMLINKS ) && +if ((cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MF_SYMLINKS ) &&couldbe_mf_symlink (&fattr))/* * trying to get the type and mode can be slow,
fs/smb/client/smb1ops.c +2 -2
@@ -1077,7 +1077,7 @@ cifs_make_node(unsigned int xid, struct inode *inode, .mtime = NO_CHANGE_64, .device = dev, }; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_SET_UID ) { +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_SET_UID ) { args.uid =current_fsuid (); args.gid =current_fsgid (); }else {
@@ -1102,7 +1102,7 @@ cifs_make_node(unsigned int xid, struct inode *inode,* SMB1 SFU emulation: should work with all servers, but only * support block and char device (no socket & fifo) */ -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UNX_EMUL )) +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_UNX_EMUL ))return rc;if (!S_ISCHR (mode) && !S_ISBLK (mode))
fs/smb/client/smb2misc.c +2 -2
@@ -495,9 +495,9 @@ cifs_convert_path_to_utf16(const char *from, struct cifs_sb_info *cifs_sb)__le16 *to;int map_type; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MAP_SFM_CHR ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MAP_SFM_CHR ) map_type =SFM_MAP_UNI_RSVD ; -else if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MAP_SPECIAL_CHR ) +else if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_MAP_SPECIAL_CHR ) map_type =SFU_MAP_UNI_RSVD ;else map_type =NO_MAP_UNI_RSVD ;
fs/smb/client/smb2ops.c +2 -2
@@ -960,7 +960,7 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, rc = -EREMOTE ; }if (rc == -EREMOTE &&IS_ENABLED (CONFIG_CIFS_DFS_UPCALL ) && cifs_sb && - (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_DFS )) + (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NO_DFS )) rc = -EOPNOTSUPP ; goto out; }
@@ -5346,7 +5346,7 @@ smb2_make_node(unsigned int xid, struct inode *inode,* supports block and char device (no socket & fifo), * and was used by default in earlier versions of Windows */ -if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UNX_EMUL )) +if (!(cifs_sb_flags (cifs_sb) &CIFS_MOUNT_UNX_EMUL ))return rc;/*
fs/smb/client/smb2pdu.c +2 -2
@@ -3038,7 +3038,7 @@ SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,bool set_mode;bool set_owner; -if ((oparms->cifs_sb->mnt_cifs_flags &CIFS_MOUNT_MODE_FROM_SID ) && +if ((cifs_sb_flags (oparms->cifs_sb) &CIFS_MOUNT_MODE_FROM_SID ) && (oparms->mode !=ACL_NO_MODE )) set_mode = true;else {
@@ -3046,7 +3046,7 @@ SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, oparms->mode =ACL_NO_MODE ; } -if (oparms->cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UID_FROM_ACL ) +if (cifs_sb_flags (oparms->cifs_sb) &CIFS_MOUNT_UID_FROM_ACL ) set_owner = true;else set_owner = false;
fs/smb/client/xattr.c +3 -3
@@ -147,7 +147,7 @@ static int cifs_xattr_set(const struct xattr_handler *handler,break ; } -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_XATTR ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NO_XATTR ) goto out;if (pTcon->ses->server->ops->set_EA) {
@@ -325,7 +325,7 @@ static int cifs_xattr_get(const struct xattr_handler *handler,break ; } -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_XATTR ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NO_XATTR ) goto out;if (pTcon->ses->server->ops->query_all_EAs)
@@ -420,7 +420,7 @@ ssize_t cifs_listxattr(struct dentry *direntry, char *data, size_t buf_size)if (unlikely (cifs_forced_shutdown (cifs_sb)))return -EIO ; -if (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_XATTR ) +if (cifs_sb_flags (cifs_sb) &CIFS_MOUNT_NO_XATTR )return -EOPNOTSUPP ; tlink =cifs_sb_tlink (cifs_sb);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
From: Paulo Alcantara <[email protected]>
[ Upstream commit da6e25842431982d5a53cf00d925b98c690f4467 ]
cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to request_key() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon.
Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected.
--- fs/smb/client/readdir.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
fs/smb/client/readdir.c +11 -5
@@ -235,8 +235,9 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, {unsigned int sbflags =cifs_sb_flags (cifs_sb);struct smb2_posix_info_parsed parsed; +int rc; -posix_info_parse (info,NULL , &parsed); + rc =posix_info_parse (info,NULL , &parsed);memset (fattr,0 ,sizeof (*fattr)); fattr->cf_uniqueid =le64_to_cpu (info->Inode);
@@ -280,10 +281,15 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, fattr->cf_uid = cifs_sb->ctx->linux_uid; fattr->cf_gid = cifs_sb->ctx->linux_gid; -if (!(sbflags &CIFS_MOUNT_OVERR_UID )) -sid_to_id (cifs_sb, &parsed.owner, fattr,SIDOWNER ); -if (!(sbflags &CIFS_MOUNT_OVERR_GID )) -sid_to_id (cifs_sb, &parsed.group, fattr,SIDGROUP ); +if (rc <0 ) { +cifs_dbg (VFS ,"%s: failed to parse SIDs: %d\n" , + __func__, rc); + }else { +if (!(sbflags &CIFS_MOUNT_OVERR_UID )) +sid_to_id (cifs_sb, &parsed.owner, fattr,SIDOWNER ); +if (!(sbflags &CIFS_MOUNT_OVERR_GID )) +sid_to_id (cifs_sb, &parsed.group, fattr,SIDGROUP ); + } }static void __dir_info_to_fattr (struct cifs_fattr *fattr,const void *info)
Signature · 1 line
2.53.0