mirror of
https://github.com/torvalds/linux.git
synced 2026-10-28 01:26:02 +01:00
0a96d0d726
A batch of bug fixes for the smb client:
- File type corruption fixes in reparse point handling: setting S_IFMT
bits without clearing the existing type first corrupted the file mode
(e.g. S_IFREG | S_IFCHR == S_IFLNK). Fixed in the WSL, POSIX and
native symlink reparse parsers. Also fixes an uninitialized SID
structure in the POSIX readdir path when parsing fails.
- Ownership mapping fixes: forceuid/forcegid mount options were
ignored in several code paths (SID-to-id mapping, WSL extended
attributes, POSIX extensions getattr), allowing an untrusted server
to dictate local file ownership despite explicit mount overrides.
- Heap overflow and overflow fixes in DACL rewriting: replacing short
SIDs with long ones could overflow the DACL buffer, and the u16
accumulator for DACL size could wrap around with enough ACEs.
- Reference count leak fixes in oplock break and deferred close:
duplicate oplock breaks on a queued work item leaked a
cifsFileInfo reference, and deferred close had a similar leak when
requeueing a running work item. Both cause busy-inode oopses on
unmount.
- DFS superblock use-after-free fix: the iterator callback stored a
raw superblock pointer without pinning it, racing with automount
expiry.
- One-byte slab OOB read in the native symlink parser when handling
share-root relative paths.
- Hardening of legacy SMB1 input: reject userspace-crafted
cifs.idmap key descriptions that bypass kernel origin checks, and
validate DataOffset in CIFSSMBRead() to prevent heap info
disclosure from a malicious server.
- DFS cache fix: defer metadata updates until target copying
succeeds to prevent partial-state cache entries on allocation
failure.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTcqRusfSdYROJQwGkpVtNKoQNdYwUCaqLMxAAKCRApVtNKoQNd
YwSyAQDUDSxCnDMmJbRr4e22oF/YrGSN/snp8cqrZlZh2pb5/gD/c2G3xMJA85YP
yL/G8auRWkpwDl0/Parqptjhx1c9YwE=
=PjPM
-----END PGP SIGNATURE-----
Merge tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara:
- File type corruption fixes in reparse point handling: setting S_IFMT
bits without clearing the existing type first corrupted the file mode
(e.g. S_IFREG | S_IFCHR == S_IFLNK). Fixed in the WSL, POSIX and
native symlink reparse parsers. Also fixes an uninitialized SID
structure in the POSIX readdir path when parsing fails.
- Ownership mapping fixes: forceuid/forcegid mount options were
ignored in several code paths (SID-to-id mapping, WSL extended
attributes, POSIX extensions getattr), allowing an untrusted server
to dictate local file ownership despite explicit mount overrides.
- Heap overflow and overflow fixes in DACL rewriting: replacing short
SIDs with long ones could overflow the DACL buffer, and the u16
accumulator for DACL size could wrap around with enough ACEs.
- Reference count leak fixes in oplock break and deferred close:
duplicate oplock breaks on a queued work item leaked a
cifsFileInfo reference, and deferred close had a similar leak when
requeueing a running work item. Both cause busy-inode oopses on
unmount.
- DFS superblock use-after-free fix: the iterator callback stored a
raw superblock pointer without pinning it, racing with automount
expiry.
- One-byte slab OOB read in the native symlink parser when handling
share-root relative paths.
- Hardening of legacy SMB1 input: reject userspace-crafted
cifs.idmap key descriptions that bypass kernel origin checks, and
validate DataOffset in CIFSSMBRead() to prevent heap info
disclosure from a malicious server.
- DFS cache fix: defer metadata updates until target copying
succeeds to prevent partial-state cache entries on allocation
failure.
* tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux:
smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
smb: client: fail DACL rewrite when the new DACL exceeds 64K
smb: client: fix heap overflow in DACL owner/group rewrite
smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
smb: client: fix file type corruption in posix_reparse_to_fattr()
smb: client: fix file type corruption in wsl_to_fattr()
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
smb: client: fix WSL reparse point uid/gid override
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
smb: client: fix uid/gid override in getattr with posix extensions
smb: client: fix cifsFileInfo reference leak in deferred close
smb: client: avoid leaking refcount when cifs_sb_tlink() fails
smb: client: avoid leaking refcount in cifs_queue_oplock_break()
smb: client: fill cache fields after populating cache in copy_ref_data()
smb: client: pin DFS superblock in iterator callback
smb: client: reject userspace cifs.idmap descriptions
smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
smb: client: reject short READ responses in CIFSSMBRead()
|
||
|---|---|---|
| .. | ||
| .gitignore | ||
| asn1.c | ||
| cached_dir.c | ||
| cached_dir.h | ||
| cifs_debug.c | ||
| cifs_debug.h | ||
| cifs_fs_sb.h | ||
| cifs_ioctl.h | ||
| cifs_spnego_negtokeninit.asn1 | ||
| cifs_spnego.c | ||
| cifs_spnego.h | ||
| cifs_swn.c | ||
| cifs_swn.h | ||
| cifs_unicode.c | ||
| cifs_unicode.h | ||
| cifsacl.c | ||
| cifsacl.h | ||
| cifsencrypt.c | ||
| cifsfs.c | ||
| cifsfs.h | ||
| cifsglob.h | ||
| cifspdu.h | ||
| cifsproto.h | ||
| cifsroot.c | ||
| cifssmb.c | ||
| compress.c | ||
| compress.h | ||
| connect.c | ||
| dfs_cache.c | ||
| dfs_cache.h | ||
| dfs.c | ||
| dfs.h | ||
| dir.c | ||
| dns_resolve.c | ||
| dns_resolve.h | ||
| export.c | ||
| file.c | ||
| fs_context.c | ||
| fs_context.h | ||
| fscache.c | ||
| fscache.h | ||
| gen_smb1_mapping | ||
| gen_smb2_mapping | ||
| inode.c | ||
| ioctl.c | ||
| Kconfig | ||
| link.c | ||
| Makefile | ||
| misc.c | ||
| namespace.c | ||
| netlink.c | ||
| netlink.h | ||
| netmisc.c | ||
| nterr.h | ||
| ntlmssp.h | ||
| readdir.c | ||
| reparse.c | ||
| reparse.h | ||
| rfc1002pdu.h | ||
| sess.c | ||
| smb1debug.c | ||
| smb1encrypt.c | ||
| smb1maperror_test.c | ||
| smb1maperror.c | ||
| smb1misc.c | ||
| smb1ops.c | ||
| smb1pdu.h | ||
| smb1proto.h | ||
| smb1session.c | ||
| smb1transport.c | ||
| smb2file.c | ||
| smb2glob.h | ||
| smb2inode.c | ||
| smb2maperror_test.c | ||
| smb2maperror.c | ||
| smb2misc.c | ||
| smb2ops.c | ||
| smb2pdu.c | ||
| smb2pdu.h | ||
| smb2proto.h | ||
| smb2transport.c | ||
| smbdirect.c | ||
| smbdirect.h | ||
| smbencrypt.c | ||
| smberr.h | ||
| trace.c | ||
| trace.h | ||
| transport.c | ||
| unc.c | ||
| winucase.c | ||
| xattr.c | ||