Merge tag '6.2-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French: "cifs/smb3 client fixes: - two multichannel fixes - three reconnect fixes - unmap fix" * tag '6.2-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix interface count calculation during refresh cifs: refcount only the selected iface during interface update cifs: protect access of TCP_Server_Info::{dstaddr,hostname} cifs: fix race in assemble_neg_contexts() cifs: ignore ipc reconnect failures during dfs failover cifs: Fix kmap_local_page() unmapping

Linus Torvalds committed 3 years ago

Commit f18fca92 parents 0007c04 cc7d79d5 files · +27 −26Browse files

Unified · Split

5 files

fs/cifs/dfs.c +12 −13
fs/cifs/misc.c +2 −0
fs/cifs/sess.c +2 −1
fs/cifs/smb2ops.c +4 −8
fs/cifs/smb2pdu.c +7 −4

fs/cifs/dfs.c+12−13

 	return rc;
 }
-static int target_share_matches_server(struct TCP_Server_Info *server, const char *tcp_host,
+static int target_share_matches_server(struct TCP_Server_Info *server, char *share,
-				       size_t tcp_host_len, char *share, bool *target_match)
+				       bool *target_match)
 {
 	int rc = 0;
 	const char *dfs_host;
 	extract_unc_hostname(share, &dfs_host, &dfs_host_len);
 	/* Check if hostnames or addresses match */
-	if (dfs_host_len != tcp_host_len || strncasecmp(dfs_host, tcp_host, dfs_host_len) != 0) {
+	cifs_server_lock(server);
-		cifs_dbg(FYI, "%s: %.*s doesn't match %.*s\n", __func__, (int)dfs_host_len,
+	if (dfs_host_len != strlen(server->hostname) ||
-			 dfs_host, (int)tcp_host_len, tcp_host);
+	    strncasecmp(dfs_host, server->hostname, dfs_host_len)) {
+		cifs_dbg(FYI, "%s: %.*s doesn't match %s\n", __func__,
+			 (int)dfs_host_len, dfs_host, server->hostname);
 		rc = match_target_ip(server, dfs_host, dfs_host_len, target_match);
 		if (rc)
 			cifs_dbg(VFS, "%s: failed to match target ip: %d\n", __func__, rc);
 	}
+	cifs_server_unlock(server);
 	return rc;
 }
 	struct cifs_ses *root_ses = CIFS_DFS_ROOT_SES(tcon->ses);
 	struct cifs_tcon *ipc = root_ses->tcon_ipc;
 	char *share = NULL, *prefix = NULL;
-	const char *tcp_host;
-	size_t tcp_host_len;
 	struct dfs_cache_tgt_iterator *tit;
 	bool target_match;
-	extract_unc_hostname(server->hostname, &tcp_host, &tcp_host_len);
 	tit = dfs_cache_get_tgt_iterator(tl);
 	if (!tit) {
 		rc = -ENOENT;
 			break;
 		}
-		rc = target_share_matches_server(server, tcp_host, tcp_host_len, share,
+		rc = target_share_matches_server(server, share, &target_match);
-						 &target_match);
 		if (rc)
 			break;
 		if (!target_match) {
 		if (ipc->need_reconnect) {
 			scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", server->hostname);
 			rc = ops->tree_connect(xid, ipc->ses, tree, ipc, cifs_sb->local_nls);
-			if (rc)
+			cifs_dbg(FYI, "%s: reconnect ipc: %d\n", __func__, rc);
-				break;
 		}
 		scnprintf(tree, MAX_TREE_SIZE, "\\%s", share);
 	}
 	if (tcon->ipc) {
+		cifs_server_lock(server);
 		scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", server->hostname);
+		cifs_server_unlock(server);
 		rc = ops->tree_connect(xid, tcon->ses, tree, tcon, nlsc);
 		goto out;
 	}

fs/cifs/misc.c+2−0

 	if (rc < 0)
 		return rc;
+	spin_lock(&server->srv_lock);
 	*result = cifs_match_ipaddr((struct sockaddr *)&server->dstaddr, (struct sockaddr *)&ss);
+	spin_unlock(&server->srv_lock);
 	cifs_dbg(FYI, "%s: ip addresses match: %u\n", __func__, *result);
 	return 0;
 }

fs/cifs/sess.c+2−1

 			continue;
 		}
 		kref_get(&iface->refcount);
+		break;
 	}
-	if (!list_entry_is_head(iface, &ses->iface_list, iface_head)) {
+	if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
 		rc = 1;
 		iface = NULL;
 		cifs_dbg(FYI, "unable to find a suitable iface\n");

fs/cifs/smb2ops.c+4−8

 	p = buf;
 	spin_lock(&ses->iface_lock);
-	ses->iface_count = 0;
 	/*
 	 * Go through iface_list and do kref_put to remove
 	 * any unused ifaces. ifaces in use will be removed
 				 iface_head) {
 		iface->is_active = 0;
 		kref_put(&iface->refcount, release_iface);
+		ses->iface_count--;
 	}
 	spin_unlock(&ses->iface_lock);
 				/* just get a ref so that it doesn't get picked/freed */
 				iface->is_active = 1;
 				kref_get(&iface->refcount);
+				ses->iface_count++;
 				spin_unlock(&ses->iface_lock);
 				goto next_iface;
 			} else if (ret < 0) {
 		/* copy pages form the old */
 		for (j = 0; j < npages; j++) {
-			char *dst, *src;
 			unsigned int offset, len;
 			rqst_page_get_length(new, j, &len, &offset);
-			dst = kmap_local_page(new->rq_pages[j]) + offset;
+			memcpy_page(new->rq_pages[j], offset,
-			src = kmap_local_page(old->rq_pages[j]) + offset;
+				    old->rq_pages[j], offset, len);
-			memcpy(dst, src, len);
-			kunmap(new->rq_pages[j]);
-			kunmap(old->rq_pages[j]);
 		}
 	}

fs/cifs/smb2pdu.c+7−4

 assemble_neg_contexts(struct smb2_negotiate_req *req,
 		      struct TCP_Server_Info *server, unsigned int *total_len)
 {
-	char *pneg_ctxt;
-	char *hostname = NULL;
 	unsigned int ctxt_len, neg_context_count;
+	struct TCP_Server_Info *pserver;
+	char *pneg_ctxt;
+	char *hostname;
 	if (*total_len > 200) {
 		/* In case length corrupted don't want to overrun smb buffer */
 	 * secondary channels don't have the hostname field populated
 	 * use the hostname field in the primary channel instead
 	 */
-	hostname = CIFS_SERVER_IS_CHAN(server) ?
+	pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server;
-		server->primary_server->hostname : server->hostname;
+	cifs_server_lock(pserver);
+	hostname = pserver->hostname;
 	if (hostname && (hostname[0] != 0)) {
 		ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt,
 					      hostname);
 		neg_context_count = 3;
 	} else
 		neg_context_count = 2;
+	cifs_server_unlock(pserver);
 	build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt);
 	*total_len += sizeof(struct smb2_posix_neg_context);