Eric Lee / smarc-fsl-linux-kernel

07 Dec, 2019

1 commit

  • fdef665ba   smb3: fix mode passed in on create for modetosid mount option ... Browse Code »

    When using the special SID to store the mode bits in an ACE (See
    http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx)
    which is enabled with mount parm "modefromsid" we were not
    passing in the mode via SMB3 create (although chmod was enabled).
    SMB3 create allows a security descriptor context to be passed
    in (which is more atomic and thus preferable to setting the mode
    bits after create via a setinfo).

    This patch enables setting the mode bits on create when using
    modefromsid mount option. In addition it fixes an endian
    error in the definition of the Control field flags in the SMB3
    security descriptor. It also makes the ACE type of the special
    SID better match the documentation (and behavior of servers
    which use this to store mode bits in SMB3 ACLs).

    Signed-off-by: Steve French
    Acked-by: Ronnie Sahlberg
    Reviewed-by: Pavel Shilovsky

    Steve French
     

27 Sep, 2019

1 commit

  • ff3ee62a5   smb3: missing ACL related flags ... Browse Code »

    Various SMB3 ACL related flags (for security descriptor and
    ACEs for example) were missing and some fields are different
    in SMB3 and CIFS. Update cifsacl.h definitions based on
    current MS-DTYP specification.

    Signed-off-by: Steve French
    Reviewed-by: Ronnie Sahlberg
    Reviewed-by: Aurelien Aptel

    Steve French
     

17 Sep, 2019

1 commit

  • 0892ba693   cifs: modefromsid: make room for 4 ACE ... Browse Code »

    when mounting with modefromsid, we end up writing 4 ACE in a security
    descriptor that only has room for 3, thus triggering an out-of-bounds
    write. fix this by changing the min size of a security descriptor.

    Signed-off-by: Aurelien Aptel
    Signed-off-by: Steve French

    Aurelien Aptel
     

05 Jun, 2018

1 commit

  • ee25c6dd7   cifs: For SMB2 security informaion query, check for minimum sized security descr… ... Browse Code »

    …iptor instead of sizeof FileAllInformation class

    Validate_buf () function checks for an expected minimum sized response
    passed to query_info() function.
    For security information, the size of a security descriptor can be
    smaller (one subauthority, no ACEs) than the size of the structure
    that defines FileInfoClass of FileAllInformation.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199725
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
    Reviewed-by: Noah Morrison <noah.morrison@rubrik.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>

    Shirish Pargaonkar
     

12 Dec, 2012

1 commit

  • 193cdd8a2   cifs: fix SID binary to string conversion ... Browse Code »

    The authority fields are supposed to be represented by a single 48-bit
    value. It's also supposed to represent the value as hex if it's equal to
    or greater than 2^32. This is documented in MS-DTYP, section 2.4.2.1.

    Also, fix up the max string length to account for this fix.

    Acked-by: Pavel Shilovsky
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     

09 Dec, 2012

2 commits

  • 7ee0b4c63   cifs: fix hardcoded default security descriptor length ... Browse Code »

    It was hardcoded to 192 bytes, which was not enough when the max number
    of subauthorities went to 15. Redefine this constant in terms of sizeof
    the structs involved, and rename it for better clarity.

    While we're at it, remove a couple more unused constants from cifsacl.h.

    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     
  • faa65f07d   cifs: simplify id_to_sid and sid_to_id mapping code ... Browse Code »

    The cifs.idmap handling code currently causes the kernel to cache the
    data from userspace twice. It first looks in a rbtree to see if there is
    a matching entry for the given id. If there isn't then it calls
    request_key which then checks its cache and then calls out to userland
    if it doesn't have one. If the userland program establishes a mapping
    and downcalls with that info, it then gets cached in the keyring and in
    this rbtree.

    Aside from the double memory usage and the performance penalty in doing
    all of these extra copies, there are some nasty bugs in here too. The
    code declares four rbtrees and spinlocks to protect them, but only seems
    to use two of them. The upshot is that the same tree is used to hold
    (eg) uid:sid and sid:uid mappings. The comparitors aren't equipped to
    deal with that.

    I think we'd be best off to remove a layer of caching in this code. If
    this was originally done for performance reasons, then that really seems
    like a premature optimization.

    This patch does that -- it removes the rbtrees and the locks that
    protect them and simply has the code do a request_key call on each call
    into sid_to_id and id_to_sid. This greatly simplifies this code and
    should roughly halve the memory utilization from using the idmapping
    code.

    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     

06 Dec, 2012

5 commits

19 May, 2011

2 commits

  • c4aca0c09   cifs: Change key name to cifs.idmap, misc. clean-up ... Browse Code »

    Change idmap key name from cifs.cifs_idmap to cifs.idmap.
    Removed unused structure wksidarr and function match_sid().
    Handle errors correctly in function init_cifs().

    Signed-off-by: Shirish Pargaonkar
    Reviewed-by: Jeff Layton
    Signed-off-by: Steve French

    Shirish Pargaonkar
     
  • 9409ae58e   cifs: Invoke id mapping functions (try #17 repost) ... Browse Code »

    rb tree search and insertion routines.

    A SID which needs to be mapped, is looked up in one of the rb trees
    depending on whether SID is either owner or group SID.
    If found in the tree, a (mapped) id from that node is assigned to
    uid or gid as appropriate. If unmapped, an upcall is attempted to
    map the SID to an id. If upcall is successful, node is marked as
    mapped. If upcall fails, node stays marked as unmapped and a mapping
    is attempted again only after an arbitrary time period has passed.

    To map a SID, which can be either a Owner SID or a Group SID, key
    description starts with the string "os" or "gs" followed by SID converted
    to a string. Without "os" or "gs", cifs.upcall does not know whether
    SID needs to be mapped to either an uid or a gid.

    Nodes in rb tree have fields to prevent multiple upcalls for
    a SID. Searching, adding, and removing nodes is done within global locks.
    Whenever a node is either found or inserted in a tree, a reference
    is taken on that node.
    Shrinker routine prunes a node if it has expired but does not prune
    an expired node if its refcount is not zero (i.e. sid/id of that node
    is_being/will_be accessed).
    Thus a node, if its SID needs to be mapped by making an upcall,
    can safely stay and its fields accessed without shrinker pruning it.
    A reference (refcount) is put on the node without holding the spinlock
    but a reference is get on the node by holding the spinlock.

    Every time an existing mapped node is accessed or mapping is attempted,
    its timestamp is updated to prevent it from getting erased or a
    to prevent multiple unnecessary repeat mapping retries respectively.

    For now, cifs.upcall is only used to map a SID to an id (uid or gid) but
    it would be used to obtain an SID for an id.

    Signed-off-by: Shirish Pargaonkar
    Reviewed-by: Jeff Layton
    Signed-off-by: Steve French

    Shirish Pargaonkar
     

07 Dec, 2010

1 commit

  • 79df1baee   cifs: fix use of CONFIG_CIFS_ACL ... Browse Code »

    Some of the code under CONFIG_CIFS_ACL is dependent upon code under
    CONFIG_CIFS_EXPERIMENTAL, but the Kconfig options don't reflect that
    dependency. Move more of the ACL code out from under
    CONFIG_CIFS_EXPERIMENTAL and under CONFIG_CIFS_ACL.

    Also move find_readable_file out from other any sort of Kconfig
    option and make it a function normally compiled in.

    Reported-and-Acked-by: Randy Dunlap
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     

10 Apr, 2008

1 commit

06 Nov, 2007

1 commit

26 Oct, 2007

1 commit

24 Oct, 2007

1 commit

18 Oct, 2007

1 commit

17 Oct, 2007

1 commit

15 Oct, 2007

1 commit

12 Oct, 2007

1 commit

04 Oct, 2007

1 commit

02 Oct, 2007

1 commit

26 Sep, 2007

1 commit

25 Sep, 2007

1 commit

29 Sep, 2006

1 commit

14 Jan, 2006

1 commit

09 Jan, 2006

1 commit

02 Dec, 2005

1 commit