09 Nov, 2010
2 commits
-
Andrew Hendry reported a kmemleak warning in 2.6.37-rc1 while editing a
text file with gedit over cifs.unreferenced object 0xffff88022ee08b40 (size 32):
comm "gedit", pid 2524, jiffies 4300160388 (age 2633.655s)
hex dump (first 32 bytes):
5c 2e 67 6f 75 74 70 75 74 73 74 72 65 61 6d 2d \.goutputstream-
35 42 41 53 4c 56 00 de 09 00 00 00 2c 26 78 ee 5BASLV......,&x.
backtrace:
[] kmemleak_alloc+0x2d/0x60
[] __kmalloc+0xe3/0x1d0
[] build_path_from_dentry+0xf0/0x230 [cifs]
[] cifs_setattr+0x9e/0x770 [cifs]
[] notify_change+0x170/0x2e0
[] sys_fchmod+0x10b/0x140
[] system_call_fastpath+0x16/0x1b
[] 0xffffffffffffffffThe commit 1025774c that removed inode_setattr() seems to have introduced this
memleak by returning early without freeing 'full_path'.Reported-by: Andrew Hendry
Cc: Christoph Hellwig
Reviewed-by: Jeff Layton
Signed-off-by: Suresh Jayaraman
Signed-off-by: Steve French -
Commit 13cfb7334e made cifs_ioctl use the tlink attached to the
cifsFileInfo for a filp. This ignores the case of an open directory
however, which in CIFS can have a NULL private_data until a readdir
is done on it.This patch re-adds the NULL pointer checks that were removed in commit
50ae28f01 and moves the setting of tcon and "caps" variables lower.Long term, a better fix would be to establish a f_op->open routine for
directories that populates that field at open time, but that requires
some other changes to how readdir calls are handled.Reported-by: Kjell Rune Skaaraas
Reviewed-and-Tested-by: Suresh Jayaraman
Signed-off-by: Jeff Layton
Signed-off-by: Steve French
06 Nov, 2010
1 commit
-
All the callers already have a pointer to struct cifsInodeInfo. Use it.
Signed-off-by: Suresh Jayaraman
Signed-off-by: Pavel Shilovsky
Signed-off-by: Steve French
05 Nov, 2010
2 commits
-
This patch is based on Dan's original patch. His original description is
below:Smatch complained about a couple checking for NULL after dereferencing
bugs. I'm not super familiar with the code so I did the conservative
thing and move the dereferences after the checks.The dereferences in cifs_lock() and cifs_fsync() were added in
ba00ba64cf0 "cifs: make various routines use the cifsFileInfo->tcon
pointer". The dereference in find_writable_file() was added in
6508d904e6f "cifs: have find_readable/writable_file filter by fsuid".
The comments there say it's possible to trigger the NULL dereference
under stress.Signed-off-by: Dan Carpenter
Signed-off-by: Jeff Layton
Signed-off-by: Steve French -
Noticed while reviewing (late) the rbtree conversion patchset (which has been merged
already).Cc: Jeff Layton
Signed-off-by: Suresh Jayaraman
Signed-off-by: Steve French
03 Nov, 2010
5 commits
-
Signed-off-by: Steve French
-
Radix trees are ideal when you want to track a bunch of pointers and
can't embed a tracking structure within the target of those pointers.
The tradeoff is an increase in memory, particularly if the tree is
sparse.In CIFS, we use the tlink_tree to track tcon_link structs. A tcon_link
can never be in more than one tlink_tree, so there's no impediment to
using a rb_tree here instead of a radix tree.Convert the new multiuser mount code to use a rb_tree instead. This
should reduce the memory required to manage the tlink_tree.Signed-off-by: Jeff Layton
Signed-off-by: Steve French -
This is the second version of this patch, the only difference between
it and the first one is that this explicitly makes cifs_sb_master_tlink
a static inline.Instead of keeping a tag on the master tlink in the tree, just keep a
pointer to the master in the superblock. That eliminates the need for
using the radix tree to look up a tagged entry.Signed-off-by: Jeff Layton
Signed-off-by: Steve French -
Signed-off-by: J. Bruce Fields
Signed-off-by: Steve French -
Simplify many places when we need to set oplock level on an inode.
Signed-off-by: Pavel Shilovsky
Reviewed-by: Jeff Layton
Signed-off-by: Steve French
02 Nov, 2010
1 commit
-
Stanse found that pSMBFile in cifs_ioctl and file->f_path.dentry in
cifs_user_write are dereferenced prior their test to NULL.The alternative is not to dereference them before the tests. The patch is
to point out the problem, you have to decide.While at it we cache the inode in cifs_user_write to a local variable
and use all over the function.Signed-off-by: Jiri Slaby
Cc: Steve French
Cc: linux-cifs@vger.kernel.org
Cc: Jeff Layton
Cc: Christoph Hellwig
Signed-off-by: Steve French
31 Oct, 2010
2 commits
-
The caller allocated it, the caller should free it.
The only issue so far is that we could change the flp pointer even on an
error return if the fl_change callback failed. But we can simply move
the flp assignment after the fl_change invocation, as the callers don't
care about the flp return value if the setlease call failed.Signed-off-by: Christoph Hellwig
Signed-off-by: Linus Torvalds -
We modified setlease to require the caller to allocate the new lease in
the case of creating a new lease, but forgot to fix up the filesystem
methods.Cc: Steven Whitehouse
Cc: Steve French
Cc: Trond Myklebust
Signed-off-by: J. Bruce Fields
Acked-by: Arnd Bergmann
Signed-off-by: Linus Torvalds
30 Oct, 2010
1 commit
-
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
cifs: Cleanup and thus reduce smb session structure and fields used during authentication
NTLM auth and sign - Use appropriate server challenge
cifs: add kfree() on error path
NTLM auth and sign - minor error corrections and cleanup
NTLM auth and sign - Use kernel crypto apis to calculate hashes and smb signatures
NTLM auth and sign - Define crypto hash functions and create and send keys needed for key exchange
cifs: cifs_convert_address() returns zero on error
NTLM auth and sign - Allocate session key/client response dynamically
cifs: update comments - [s/GlobalSMBSesLock/cifs_file_list_lock/g]
cifs: eliminate cifsInodeInfo->write_behind_rc (try #6)
[CIFS] Fix checkpatch warnings and bump cifs version number
cifs: wait for writeback to complete in cifs_flush
cifs: convert cifsFileInfo->count to non-atomic counter
29 Oct, 2010
3 commits
-
Signed-off-by: Al Viro
-
Removed following fields from smb session structure
cryptkey, ntlmv2_hash, tilen, tiblob
and ntlmssp_auth structure is allocated dynamically only if the auth mech
in NTLMSSP.response field within a session_key structure is used to initially store the
target info (either plucked from type 2 challenge packet in case of NTLMSSP
or fabricated in case of NTLMv2 without extended security) and then to store
Message Authentication Key (mak) (session key + client response).Server challenge or cryptkey needed during a NTLMSSP authentication
is now part of ntlmssp_auth structure which gets allocated and freed
once authenticaiton process is done.Signed-off-by: Shirish Pargaonkar
Signed-off-by: Steve French -
Need to have cryptkey or server challenge in smb connection
(struct TCP_Server_Info) for ntlm and ntlmv2 auth types for which
cryptkey (Encryption Key) is supplied just once in Negotiate Protocol
response during an smb connection setup for all the smb sessions over
that smb connection.For ntlmssp, cryptkey or server challenge is provided for every
smb session in type 2 packet of ntlmssp negotiation, the cryptkey
provided during Negotiation Protocol response before smb connection
does not count.Rename cryptKey to cryptkey and related changes.
Signed-off-by: Shirish Pargaonkar
Signed-off-by: Steve French
28 Oct, 2010
1 commit
-
We leak 256 bytes here on this error path.
Signed-off-by: Dan Carpenter
Acked-by: Jeff Layton
Signed-off-by: Steve French
27 Oct, 2010
6 commits
-
Minor cleanup - Fix spelling mistake, make meaningful (goto) label
In function setup_ntlmv2_rsp(), do not return 0 and leak memory,
let the tiblob get freed.For function find_domain_name(), pass already available nls table pointer
instead of loading and unloading the table again in this function.For ntlmv2, the case sensitive password length is the length of the
response, so subtract session key length (16 bytes) from the .len.Signed-off-by: Shirish Pargaonkar
Signed-off-by: Steve French -
This removes more dead code that was somehow missed by commit 0d99519efef
(writeback: remove unused nonblocking and congestion checks). There are
no behavior change except for the removal of two entries from one of the
ext4 tracing interface.The nonblocking checks in ->writepages are no longer used because the
flusher now prefer to block on get_request_wait() than to skip inodes on
IO congestion. The latter will lead to more seeky IO.The nonblocking checks in ->writepage are no longer used because it's
redundant with the WB_SYNC_NONE check.We no long set ->nonblocking in VM page out and page migration, because
a) it's effectively redundant with WB_SYNC_NONE in current code
b) it's old semantic of "Don't get stuck on request queues" is mis-behavior:
that would skip some dirty inodes on congestion and page out others, which
is unfair in terms of LRU age.Inspired by Christoph Hellwig. Thanks!
Signed-off-by: Wu Fengguang
Cc: Theodore Ts'o
Cc: David Howells
Cc: Sage Weil
Cc: Steve French
Cc: Chris Mason
Cc: Jens Axboe
Cc: Christoph Hellwig
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Use kernel crypto sync hash apis insetead of cifs crypto functions.
The calls typically corrospond one to one except that insead of
key init, setkey is used.Use crypto apis to generate smb signagtures also.
Use hmac-md5 to genereate ntlmv2 hash, ntlmv2 response, and HMAC (CR1 of
ntlmv2 auth blob.
User crypto apis to genereate signature and to verify signature.
md5 hash is used to calculate signature.
Use secondary key to calculate signature in case of ntlmssp.For ntlmv2 within ntlmssp, during signature calculation, only 16 bytes key
(a nonce) stored within session key is used. during smb signature calculation.
For ntlm and ntlmv2 without extended security, 16 bytes key
as well as entire response (24 bytes in case of ntlm and variable length
in case of ntlmv2) is used for smb signature calculation.
For kerberos, there is no distinction between key and response.Acked-by: Jeff Layton
Signed-off-by: Shirish Pargaonkar
Signed-off-by: Steve French -
Mark dependency on crypto modules in Kconfig.
Defining per structures sdesc and cifs_secmech which are used to store
crypto hash functions and contexts. They are stored per smb connection
and used for all auth mechs to genereate hash values and signatures.Allocate crypto hashing functions, security descriptiors, and respective
contexts when a smb/tcp connection is established.
Release them when a tcp/smb connection is taken down.md5 and hmac-md5 are two crypto hashing functions that are used
throught the life of an smb/tcp connection by various functions that
calcualte signagure and ntlmv2 hash, HMAC etc.structure ntlmssp_auth is defined as per smb connection.
ntlmssp_auth holds ciphertext which is genereated by rc4/arc4 encryption of
secondary key, a nonce using ntlmv2 session key and sent in the session key
field of the type 3 message sent by the client during ntlmssp
negotiation/exchangeA key is exchanged with the server if client indicates so in flags in
type 1 messsage and server agrees in flag in type 2 message of ntlmssp
negotiation. If both client and agree, a key sent by client in
type 3 message of ntlmssp negotiation in the session key field.
The key is a ciphertext generated off of secondary key, a nonce, using
ntlmv2 hash via rc4/arc4.Signing works for ntlmssp in this patch. The sequence number within
the server structure needs to be zero until session is established
i.e. till type 3 packet of ntlmssp exchange of a to be very first
smb session on that smb connection is sent.Acked-by: Jeff Layton
Signed-off-by: Shirish Pargaonkar
Signed-off-by: Steve French -
The cifs_convert_address() returns zero on error but this caller is
testing for negative returns.Btw. "i" is unsigned here, so it's never negative.
Reviewed-by: Jeff Layton
Signed-off-by: Dan Carpenter
Signed-off-by: Steve French -
Start calculating auth response within a session. Move/Add pertinet
data structures like session key, server challenge and ntlmv2_hash in
a session structure. We should do the calculations within a session
before copying session key and response over to server data
structures because a session setup can fail.Only after a very first smb session succeeds, it copy/make its
session key, session key of smb connection. This key stays with
the smb connection throughout its life.
sequence_number within server is set to 0x2.The authentication Message Authentication Key (mak) which consists
of session key followed by client response within structure session_key
is now dynamic. Every authentication type allocates the key + response
sized memory within its session structure and later either assigns or
frees it once the client response is sent and if session's session key
becomes connetion's session key.ntlm/ntlmi authentication functions are rearranged. A function
named setup_ntlm_resp(), similar to setup_ntlmv2_resp(), replaces
function cifs_calculate_session_key().size of CIFS_SESS_KEY_SIZE is changed to 16, to reflect the byte size
of the key it holds.Reviewed-by: Jeff Layton
Signed-off-by: Shirish Pargaonkar
Signed-off-by: Steve French
25 Oct, 2010
5 commits
-
GlobalSMBSesLock is now cifs_file_list_lock. Update comments to reflect this.
Signed-off-by: Suresh Jayaraman
Signed-off-by: Steve French -
write_behind_rc is redundant and just adds complexity to the code. What
we really want to do instead is to use mapping_set_error to reset the
flags on the mapping when we find a writeback error and can't report it
to userspace yet.For cifs_flush and cifs_fsync, we shouldn't reset the flags since errors
returned there do get reported to userspace.Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Reviewed-by: Dave Kleikamp
Signed-off-by: Steve French -
Signed-off-by: Steve French
-
The f_op->flush operation is the last chance to return a writeback
related error when closing a file. Ensure that we don't miss reporting
any errors by waiting for writeback to complete in cifs_flush before
proceeding.There's no reason to do this when the file isn't open for write
however.Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Reviewed-by: David Kleikamp
Signed-off-by: Steve French -
The count for cifsFileInfo is currently an atomic, but that just adds
complexity for little value. We generally need to hold cifs_file_list_lock
to traverse the lists anyway so we might as well make this counter
non-atomic and simply use the cifs_file_list_lock to protect it.Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Signed-off-by: Steve French
23 Oct, 2010
2 commits
-
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: (56 commits)
[CIFS] move close processing from cifs_close to cifsFileInfo_put
cifs: convert cifs_tcp_ses_lock from a rwlock to a spinlock
cifs: cancel_delayed_work() + flush_scheduled_work() -> cancel_delayed_work_sync()
Clean up two declarations of blob_len
cifs: move cifsFileInfo_put to file.c
cifs: convert GlobalSMBSeslock from a rwlock to regular spinlock
[CIFS] Fix minor checkpatch warning and update cifs version
cifs: move cifs_new_fileinfo to file.c
cifs: eliminate pfile pointer from cifsFileInfo
cifs: cifs_write argument change and cleanup
cifs: clean up cifs_reopen_file
cifs: eliminate the inode argument from cifs_new_fileinfo
cifs: eliminate oflags option from cifs_new_fileinfo
cifs: fix flags handling in cifs_posix_open
cifs: eliminate cifs_posix_open_inode_helper
cifs: handle FindFirst failure gracefully
NTLM authentication and signing - Calculate auth response per smb session
cifs: don't use vfsmount to pin superblock for oplock breaks
cifs: keep dentry reference in cifsFileInfo instead of inode reference
cifs: on multiuser mount, set ownership to current_fsuid/current_fsgid (try #7)
...Fix up trivial conflict in fs/cifs/cifsfs.c due to added/removed header files
-
* 'vfs' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl: (30 commits)
BKL: remove BKL from freevxfs
BKL: remove BKL from qnx4
autofs4: Only declare function when CONFIG_COMPAT is defined
autofs: Only declare function when CONFIG_COMPAT is defined
ncpfs: Lock socket in ncpfs while setting its callbacks
fs/locks.c: prepare for BKL removal
BKL: Remove BKL from ncpfs
BKL: Remove BKL from OCFS2
BKL: Remove BKL from squashfs
BKL: Remove BKL from jffs2
BKL: Remove BKL from ecryptfs
BKL: Remove BKL from afs
BKL: Remove BKL from USB gadgetfs
BKL: Remove BKL from autofs4
BKL: Remove BKL from isofs
BKL: Remove BKL from fat
BKL: Remove BKL from ext2 filesystem
BKL: Remove BKL from do_new_mount()
BKL: Remove BKL from cgroup
BKL: Remove BKL from NTFS
...
22 Oct, 2010
1 commit
-
Now that it's feasible for a cifsFileInfo to outlive the filp under
which it was created, move the close processing into cifsFileInfo_put.This means that the last user of the filehandle always does the actual
on the wire close call. This also allows us to get rid of the closePend
flag from cifsFileInfo. If we have an active reference to the file
then it's never going to have a close pending.cifs_close is converted to simply put the filehandle.
Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Signed-off-by: Steve French
21 Oct, 2010
1 commit
-
cifs_tcp_ses_lock is a rwlock with protects the cifs_tcp_ses_list,
server->smb_ses_list and the ses->tcon_list. It also protects a few
ref counters in server, ses and tcon. In most cases the critical section
doesn't seem to be large, in a few cases where it is slightly large, there
seem to be really no benefit from concurrent access. I briefly considered RCU
mechanism but it appears to me that there is no real need.Replace it with a spinlock and get rid of the last rwlock in the cifs code.
Signed-off-by: Suresh Jayaraman
Signed-off-by: Steve French
20 Oct, 2010
2 commits
-
flush_scheduled_work() is going away.
Signed-off-by: Tejun Heo
Reviewed-by: Jeff Layton
Signed-off-by: Steve French -
- Eliminate double declaration of variable blob_len
- Modify function build_ntlmssp_auth_blob to return error code
as well as length of the blob.Signed-off-by: Shirish Pargaonkar
Reviewed-by: Jeff Layton
Signed-off-by: Steve French
18 Oct, 2010
5 commits
-
...and make it non-inlined in preparation for the move of most of
cifs_close to it.Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Signed-off-by: Steve French -
Convert this lock to a regular spinlock
A rwlock_t offers little value here. It's more expensive than a regular
spinlock unless you have a fairly large section of code that runs under
the read lock and can benefit from the concurrency.Additionally, we need to ensure that the refcounting for files isn't
racy and to do that we need to lock areas that can increment it for
write. That means that the areas that can actually use a read_lock are
very few and relatively infrequently used.While we're at it, change the name to something easier to type, and fix
a bug in find_writable_file. cifsFileInfo_put can sleep and shouldn't be
called while holding the lock.Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Signed-off-by: Steve French -
Signed-off-by: Steve French
-
It's currently in dir.c which makes little sense...
Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Acked-by: Dave Kleikamp
Signed-off-by: Steve French -
All the remaining users of cifsFileInfo->pfile just use it to get
at the f_flags/f_mode. Now that we store that separately in the
cifsFileInfo, there's no need to consult the pfile at all from
a cifsFileInfo pointer.Signed-off-by: Jeff Layton
Reviewed-by: Suresh Jayaraman
Acked-by: Dave Kleikamp
Signed-off-by: Steve French