Skip to content

Commit 3bde70a

Browse files
torvaldstorvalds
committed
Merge tag 'v6.15-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French: - Fix multichannel decryption UAF - Fix regression mounting to onedrive shares - Fix missing mount option check for posix vs. noposix - Fix version field in WSL symlinks - Three minor cleanup to reparse point handling - SMB1 fix for WSL special files - SMB1 Kerberos fix - Add SMB3 defines for two new FS attributes * tag 'v6.15-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb3: Add defines for two new FileSystemAttributes cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 cifs: Split parse_reparse_point callback to functions: get buffer and parse buffer cifs: Improve handling of name surrogate reparse points in reparse.c cifs: Remove explicit handling of IO_REPARSE_TAG_MOUNT_POINT in inode.c cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode smb: client: fix UAF in decryption with multichannel cifs: Fix support for WSL-style symlinks smb311 client: fix missing tcon check when mounting with linux/posix extensions cifs: Ensure that all non-client-specific reparse points are processed by the server
2 parents 5d74992 + 56c283b commit 3bde70a

File tree

13 files changed

+154
-111
lines changed

13 files changed

+154
-111
lines changed

‎fs/smb/client/cifsencrypt.c‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -704,18 +704,12 @@ cifs_crypto_secmech_release(struct TCP_Server_Info *server)
704704
cifs_free_hash(&server->secmech.md5);
705705
cifs_free_hash(&server->secmech.sha512);
706706

707-
if (!SERVER_IS_CHAN(server)) {
708-
if (server->secmech.enc) {
709-
crypto_free_aead(server->secmech.enc);
710-
server->secmech.enc = NULL;
711-
}
712-
713-
if (server->secmech.dec) {
714-
crypto_free_aead(server->secmech.dec);
715-
server->secmech.dec = NULL;
716-
}
717-
} else {
707+
if (server->secmech.enc) {
708+
crypto_free_aead(server->secmech.enc);
718709
server->secmech.enc = NULL;
710+
}
711+
if (server->secmech.dec) {
712+
crypto_free_aead(server->secmech.dec);
719713
server->secmech.dec = NULL;
720714
}
721715
}

‎fs/smb/client/cifsglob.h‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -625,10 +625,8 @@ struct smb_version_operations {
625625
bool (*is_status_io_timeout)(char *buf);
626626
/* Check for STATUS_NETWORK_NAME_DELETED */
627627
bool (*is_network_name_deleted)(char *buf, struct TCP_Server_Info *srv);
628-
int (*parse_reparse_point)(struct cifs_sb_info *cifs_sb,
629-
const char *full_path,
630-
struct kvec *rsp_iov,
631-
struct cifs_open_info_data *data);
628+
struct reparse_data_buffer * (*get_reparse_point_buffer)(const struct kvec *rsp_iov,
629+
u32 *plen);
632630
int (*create_reparse_symlink)(const unsigned int xid,
633631
struct inode *inode,
634632
struct dentry *dentry,

‎fs/smb/client/cifspdu.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2256,6 +2256,8 @@ typedef struct {
22562256
#define FILE_SUPPORTS_ENCRYPTION 0x00020000
22572257
#define FILE_SUPPORTS_OBJECT_IDS 0x00010000
22582258
#define FILE_VOLUME_IS_COMPRESSED 0x00008000
2259+
#define FILE_SUPPORTS_POSIX_UNLINK_RENAME 0x00000400
2260+
#define FILE_RETURNS_CLEANUP_RESULT_INFO 0x00000200
22592261
#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
22602262
#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
22612263
#define FILE_SUPPORTS_SPARSE_FILES 0x00000040

‎fs/smb/client/connect.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2556,6 +2556,8 @@ static int match_tcon(struct cifs_tcon *tcon, struct smb3_fs_context *ctx)
25562556
return 0;
25572557
if (tcon->nodelete != ctx->nodelete)
25582558
return 0;
2559+
if (tcon->posix_extensions != ctx->linux_ext)
2560+
return 0;
25592561
return 1;
25602562
}
25612563

‎fs/smb/client/inode.c‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1203,18 +1203,17 @@ static int reparse_info_to_fattr(struct cifs_open_info_data *data,
12031203
goto out;
12041204
}
12051205
break;
1206-
case IO_REPARSE_TAG_MOUNT_POINT:
1207-
cifs_create_junction_fattr(fattr, sb);
1208-
rc = 0;
1209-
goto out;
12101206
default:
12111207
/* Check for cached reparse point data */
12121208
if (data->symlink_target || data->reparse.buf) {
12131209
rc = 0;
1214-
} else if (iov && server->ops->parse_reparse_point) {
1215-
rc = server->ops->parse_reparse_point(cifs_sb,
1216-
full_path,
1217-
iov, data);
1210+
} else if (iov && server->ops->get_reparse_point_buffer) {
1211+
struct reparse_data_buffer *reparse_buf;
1212+
u32 reparse_len;
1213+
1214+
reparse_buf = server->ops->get_reparse_point_buffer(iov, &reparse_len);
1215+
rc = parse_reparse_point(reparse_buf, reparse_len,
1216+
cifs_sb, full_path, data);
12181217
/*
12191218
* If the reparse point was not handled but it is the
12201219
* name surrogate which points to directory, then treat
@@ -1228,6 +1227,16 @@ static int reparse_info_to_fattr(struct cifs_open_info_data *data,
12281227
cifs_create_junction_fattr(fattr, sb);
12291228
goto out;
12301229
}
1230+
/*
1231+
* If the reparse point is unsupported by the Linux SMB
1232+
* client then let it process by the SMB server. So mask
1233+
* the -EOPNOTSUPP error code. This will allow Linux SMB
1234+
* client to send SMB OPEN request to server. If server
1235+
* does not support this reparse point too then server
1236+
* will return error during open the path.
1237+
*/
1238+
if (rc == -EOPNOTSUPP)
1239+
rc = 0;
12311240
}
12321241

12331242
if (data->reparse.tag == IO_REPARSE_TAG_SYMLINK && !rc) {

‎fs/smb/client/reparse.c‎

Lines changed: 29 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -542,12 +542,12 @@ static int wsl_set_reparse_buf(struct reparse_data_buffer **buf,
542542
kfree(symname_utf16);
543543
return -ENOMEM;
544544
}
545-
/* Flag 0x02000000 is unknown, but all wsl symlinks have this value */
546-
symlink_buf->Flags = cpu_to_le32(0x02000000);
547-
/* PathBuffer is in UTF-8 but without trailing null-term byte */
545+
/* Version field must be set to 2 (MS-FSCC 2.1.2.7) */
546+
symlink_buf->Version = cpu_to_le32(2);
547+
/* Target for Version 2 is in UTF-8 but without trailing null-term byte */
548548
symname_utf8_len = utf16s_to_utf8s((wchar_t *)symname_utf16, symname_utf16_len/2,
549549
UTF16_LITTLE_ENDIAN,
550-
symlink_buf->PathBuffer,
550+
symlink_buf->Target,
551551
symname_utf8_maxlen);
552552
*buf = (struct reparse_data_buffer *)symlink_buf;
553553
buf_len = sizeof(struct reparse_wsl_symlink_data_buffer) + symname_utf8_len;
@@ -1016,29 +1016,36 @@ static int parse_reparse_wsl_symlink(struct reparse_wsl_symlink_data_buffer *buf
10161016
struct cifs_open_info_data *data)
10171017
{
10181018
int len = le16_to_cpu(buf->ReparseDataLength);
1019+
int data_offset = offsetof(typeof(*buf), Target) - offsetof(typeof(*buf), Version);
10191020
int symname_utf8_len;
10201021
__le16 *symname_utf16;
10211022
int symname_utf16_len;
10221023

1023-
if (len <= sizeof(buf->Flags)) {
1024+
if (len <= data_offset) {
10241025
cifs_dbg(VFS, "srv returned malformed wsl symlink buffer\n");
10251026
return -EIO;
10261027
}
10271028

1028-
/* PathBuffer is in UTF-8 but without trailing null-term byte */
1029-
symname_utf8_len = len - sizeof(buf->Flags);
1029+
/* MS-FSCC 2.1.2.7 defines layout of the Target field only for Version 2. */
1030+
if (le32_to_cpu(buf->Version) != 2) {
1031+
cifs_dbg(VFS, "srv returned unsupported wsl symlink version %u\n", le32_to_cpu(buf->Version));
1032+
return -EIO;
1033+
}
1034+
1035+
/* Target for Version 2 is in UTF-8 but without trailing null-term byte */
1036+
symname_utf8_len = len - data_offset;
10301037
/*
10311038
* Check that buffer does not contain null byte
10321039
* because Linux cannot process symlink with null byte.
10331040
*/
1034-
if (strnlen(buf->PathBuffer, symname_utf8_len) != symname_utf8_len) {
1041+
if (strnlen(buf->Target, symname_utf8_len) != symname_utf8_len) {
10351042
cifs_dbg(VFS, "srv returned null byte in wsl symlink target location\n");
10361043
return -EIO;
10371044
}
10381045
symname_utf16 = kzalloc(symname_utf8_len * 2, GFP_KERNEL);
10391046
if (!symname_utf16)
10401047
return -ENOMEM;
1041-
symname_utf16_len = utf8s_to_utf16s(buf->PathBuffer, symname_utf8_len,
1048+
symname_utf16_len = utf8s_to_utf16s(buf->Target, symname_utf8_len,
10421049
UTF16_LITTLE_ENDIAN,
10431050
(wchar_t *) symname_utf16, symname_utf8_len * 2);
10441051
if (symname_utf16_len < 0) {
@@ -1062,8 +1069,6 @@ int parse_reparse_point(struct reparse_data_buffer *buf,
10621069
const char *full_path,
10631070
struct cifs_open_info_data *data)
10641071
{
1065-
struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
1066-
10671072
data->reparse.buf = buf;
10681073

10691074
/* See MS-FSCC 2.1.2 */
@@ -1090,24 +1095,17 @@ int parse_reparse_point(struct reparse_data_buffer *buf,
10901095
}
10911096
return 0;
10921097
default:
1093-
cifs_tcon_dbg(VFS | ONCE, "unhandled reparse tag: 0x%08x\n",
1094-
le32_to_cpu(buf->ReparseTag));
10951098
return -EOPNOTSUPP;
10961099
}
10971100
}
10981101

1099-
int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb,
1100-
const char *full_path,
1101-
struct kvec *rsp_iov,
1102-
struct cifs_open_info_data *data)
1102+
struct reparse_data_buffer *smb2_get_reparse_point_buffer(const struct kvec *rsp_iov,
1103+
u32 *plen)
11031104
{
1104-
struct reparse_data_buffer *buf;
11051105
struct smb2_ioctl_rsp *io = rsp_iov->iov_base;
1106-
u32 plen = le32_to_cpu(io->OutputCount);
1107-
1108-
buf = (struct reparse_data_buffer *)((u8 *)io +
1109-
le32_to_cpu(io->OutputOffset));
1110-
return parse_reparse_point(buf, plen, cifs_sb, full_path, data);
1106+
*plen = le32_to_cpu(io->OutputCount);
1107+
return (struct reparse_data_buffer *)((u8 *)io +
1108+
le32_to_cpu(io->OutputOffset));
11111109
}
11121110

11131111
static bool wsl_to_fattr(struct cifs_open_info_data *data,
@@ -1233,16 +1231,6 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
12331231
bool ok;
12341232

12351233
switch (tag) {
1236-
case IO_REPARSE_TAG_INTERNAL:
1237-
if (!(fattr->cf_cifsattrs & ATTR_DIRECTORY))
1238-
return false;
1239-
fallthrough;
1240-
case IO_REPARSE_TAG_DFS:
1241-
case IO_REPARSE_TAG_DFSR:
1242-
case IO_REPARSE_TAG_MOUNT_POINT:
1243-
/* See cifs_create_junction_fattr() */
1244-
fattr->cf_mode = S_IFDIR | 0711;
1245-
break;
12461234
case IO_REPARSE_TAG_LX_SYMLINK:
12471235
case IO_REPARSE_TAG_LX_FIFO:
12481236
case IO_REPARSE_TAG_AF_UNIX:
@@ -1262,7 +1250,14 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
12621250
fattr->cf_mode |= S_IFLNK;
12631251
break;
12641252
default:
1265-
return false;
1253+
if (!(fattr->cf_cifsattrs & ATTR_DIRECTORY))
1254+
return false;
1255+
if (!IS_REPARSE_TAG_NAME_SURROGATE(tag) &&
1256+
tag != IO_REPARSE_TAG_INTERNAL)
1257+
return false;
1258+
/* See cifs_create_junction_fattr() */
1259+
fattr->cf_mode = S_IFDIR | 0711;
1260+
break;
12661261
}
12671262

12681263
fattr->cf_dtype = S_DT(fattr->cf_mode);

‎fs/smb/client/reparse.h‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,9 +135,6 @@ int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,
135135
int smb2_mknod_reparse(unsigned int xid, struct inode *inode,
136136
struct dentry *dentry, struct cifs_tcon *tcon,
137137
const char *full_path, umode_t mode, dev_t dev);
138-
int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb,
139-
const char *full_path,
140-
struct kvec *rsp_iov,
141-
struct cifs_open_info_data *data);
138+
struct reparse_data_buffer *smb2_get_reparse_point_buffer(const struct kvec *rsp_iov, u32 *len);
142139

143140
#endif /* _CIFS_REPARSE_H */

‎fs/smb/client/sess.c‎

Lines changed: 40 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -680,6 +680,22 @@ unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
680680
*pbcc_area = bcc_ptr;
681681
}
682682

683+
static void
684+
ascii_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
685+
{
686+
char *bcc_ptr = *pbcc_area;
687+
688+
strcpy(bcc_ptr, "Linux version ");
689+
bcc_ptr += strlen("Linux version ");
690+
strcpy(bcc_ptr, init_utsname()->release);
691+
bcc_ptr += strlen(init_utsname()->release) + 1;
692+
693+
strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
694+
bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
695+
696+
*pbcc_area = bcc_ptr;
697+
}
698+
683699
static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
684700
const struct nls_table *nls_cp)
685701
{
@@ -704,6 +720,25 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
704720
*pbcc_area = bcc_ptr;
705721
}
706722

723+
static void ascii_domain_string(char **pbcc_area, struct cifs_ses *ses,
724+
const struct nls_table *nls_cp)
725+
{
726+
char *bcc_ptr = *pbcc_area;
727+
int len;
728+
729+
/* copy domain */
730+
if (ses->domainName != NULL) {
731+
len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
732+
if (WARN_ON_ONCE(len < 0))
733+
len = CIFS_MAX_DOMAINNAME_LEN - 1;
734+
bcc_ptr += len;
735+
} /* else we send a null domain name so server will default to its own domain */
736+
*bcc_ptr = 0;
737+
bcc_ptr++;
738+
739+
*pbcc_area = bcc_ptr;
740+
}
741+
707742
static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
708743
const struct nls_table *nls_cp)
709744
{
@@ -749,25 +784,10 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
749784
*bcc_ptr = 0;
750785
bcc_ptr++; /* account for null termination */
751786

752-
/* copy domain */
753-
if (ses->domainName != NULL) {
754-
len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
755-
if (WARN_ON_ONCE(len < 0))
756-
len = CIFS_MAX_DOMAINNAME_LEN - 1;
757-
bcc_ptr += len;
758-
} /* else we send a null domain name so server will default to its own domain */
759-
*bcc_ptr = 0;
760-
bcc_ptr++;
761-
762787
/* BB check for overflow here */
763788

764-
strcpy(bcc_ptr, "Linux version ");
765-
bcc_ptr += strlen("Linux version ");
766-
strcpy(bcc_ptr, init_utsname()->release);
767-
bcc_ptr += strlen(init_utsname()->release) + 1;
768-
769-
strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
770-
bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
789+
ascii_domain_string(&bcc_ptr, ses, nls_cp);
790+
ascii_oslm_strings(&bcc_ptr, nls_cp);
771791

772792
*pbcc_area = bcc_ptr;
773793
}
@@ -1570,7 +1590,7 @@ sess_auth_kerberos(struct sess_data *sess_data)
15701590
sess_data->iov[1].iov_len = msg->secblob_len;
15711591
pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
15721592

1573-
if (ses->capabilities & CAP_UNICODE) {
1593+
if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
15741594
/* unicode strings must be word aligned */
15751595
if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
15761596
*bcc_ptr = 0;
@@ -1579,8 +1599,8 @@ sess_auth_kerberos(struct sess_data *sess_data)
15791599
unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
15801600
unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
15811601
} else {
1582-
/* BB: is this right? */
1583-
ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1602+
ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1603+
ascii_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
15841604
}
15851605

15861606
sess_data->iov[2].iov_len = (long) bcc_ptr -

0 commit comments

Comments
 (0)