Commit 555f3d7b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag '5.17-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd 

Pull ksmbd server fixes from Steve French:

 - NTLMSSP authentication improvement

 - RDMA (smbdirect) fix allowing broader set of NICs to be supported

 - improved buffer validation

 - additional small fixes, including a posix extensions fix for stable

* tag '5.17-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: add support for key exchange
  ksmbd: reduce smb direct max read/write size
  ksmbd: don't align last entry offset in smb2 query directory
  ksmbd: fix same UniqueId for dot and dotdot entries
  ksmbd: smbd: validate buffer descriptor structures
  ksmbd: fix SMB 3.11 posix extension mount failure
parents 2ade8eef f9929ef6

fs/Kconfig

+2 −2
Original line number Diff line number Diff line
@@ -369,8 +369,8 @@ source "fs/ksmbd/Kconfig" 


config SMBFS_COMMON

	tristate

	default y if CIFS=y

	default m if CIFS=m

	default y if CIFS=y || SMB_SERVER=y

	default m if CIFS=m || SMB_SERVER=m



source "fs/coda/Kconfig"

source "fs/afs/Kconfig"

fs/ksmbd/auth.c

+27 −0
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ 
#include "mgmt/user_config.h"

#include "crypto_ctx.h"

#include "transport_ipc.h"

#include "../smbfs_common/arc4.h"



/*

 * Fixed format data defining GSS header and fixed string
@@ -336,6 +337,29 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob, 
				nt_len - CIFS_ENCPWD_SIZE,

				domain_name, conn->ntlmssp.cryptkey);

	kfree(domain_name);



	/* The recovered secondary session key */

	if (conn->ntlmssp.client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) {

		struct arc4_ctx *ctx_arc4;

		unsigned int sess_key_off, sess_key_len;



		sess_key_off = le32_to_cpu(authblob->SessionKey.BufferOffset);

		sess_key_len = le16_to_cpu(authblob->SessionKey.Length);



		if (blob_len < (u64)sess_key_off + sess_key_len)

			return -EINVAL;



		ctx_arc4 = kmalloc(sizeof(*ctx_arc4), GFP_KERNEL);

		if (!ctx_arc4)

			return -ENOMEM;



		cifs_arc4_setkey(ctx_arc4, sess->sess_key,

				 SMB2_NTLMV2_SESSKEY_SIZE);

		cifs_arc4_crypt(ctx_arc4, sess->sess_key,

				(char *)authblob + sess_key_off, sess_key_len);

		kfree_sensitive(ctx_arc4);

	}



	return ret;

}
@@ -408,6 +432,9 @@ ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob, 
	    (cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))

		flags |= NTLMSSP_NEGOTIATE_EXTENDED_SEC;



	if (cflags & NTLMSSP_NEGOTIATE_KEY_XCH)

		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;



	chgblob->NegotiateFlags = cpu_to_le32(flags);

	len = strlen(ksmbd_netbios_name());

	name = kmalloc(2 + UNICODE_LEN(len), GFP_KERNEL);

fs/ksmbd/smb2pdu.c

+35 −10
Original line number Diff line number Diff line
@@ -2688,7 +2688,7 @@ int smb2_open(struct ksmbd_work *work) 
					(struct create_posix *)context;

				if (le16_to_cpu(context->DataOffset) +

				    le32_to_cpu(context->DataLength) <

				    sizeof(struct create_posix)) {

				    sizeof(struct create_posix) - 4) {

					rc = -EINVAL;

					goto err_out1;

				}
@@ -3422,9 +3422,9 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, 
		goto free_conv_name;

	}



	struct_sz = readdir_info_level_struct_sz(info_level);

	next_entry_offset = ALIGN(struct_sz - 1 + conv_len,

				  KSMBD_DIR_INFO_ALIGNMENT);

	struct_sz = readdir_info_level_struct_sz(info_level) - 1 + conv_len;

	next_entry_offset = ALIGN(struct_sz, KSMBD_DIR_INFO_ALIGNMENT);

	d_info->last_entry_off_align = next_entry_offset - struct_sz;



	if (next_entry_offset > d_info->out_buf_len) {

		d_info->out_buf_len = 0;
@@ -3976,6 +3976,7 @@ int smb2_query_dir(struct ksmbd_work *work) 
		((struct file_directory_info *)

		((char *)rsp->Buffer + d_info.last_entry_offset))

		->NextEntryOffset = 0;

		d_info.data_count -= d_info.last_entry_off_align;



		rsp->StructureSize = cpu_to_le16(9);

		rsp->OutputBufferOffset = cpu_to_le16(72);
@@ -6126,13 +6127,26 @@ static int smb2_set_remote_key_for_rdma(struct ksmbd_work *work, 
					__le16 ChannelInfoOffset,

					__le16 ChannelInfoLength)

{

	unsigned int i, ch_count;



	if (work->conn->dialect == SMB30_PROT_ID &&

	    Channel != SMB2_CHANNEL_RDMA_V1)

		return -EINVAL;



	if (ChannelInfoOffset == 0 ||

	    le16_to_cpu(ChannelInfoLength) < sizeof(*desc))

	ch_count = le16_to_cpu(ChannelInfoLength) / sizeof(*desc);

	if (ksmbd_debug_types & KSMBD_DEBUG_RDMA) {

		for (i = 0; i < ch_count; i++) {

			pr_info("RDMA r/w request %#x: token %#x, length %#x\n",

				i,

				le32_to_cpu(desc[i].token),

				le32_to_cpu(desc[i].length));

		}

	}

	if (ch_count != 1) {

		ksmbd_debug(RDMA, "RDMA multiple buffer descriptors %d are not supported yet\n",

			    ch_count);

		return -EINVAL;

	}



	work->need_invalidate_rkey =

		(Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE);
@@ -6185,9 +6199,15 @@ int smb2_read(struct ksmbd_work *work) 


	if (req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE ||

	    req->Channel == SMB2_CHANNEL_RDMA_V1) {

		unsigned int ch_offset = le16_to_cpu(req->ReadChannelInfoOffset);



		if (ch_offset < offsetof(struct smb2_read_req, Buffer)) {

			err = -EINVAL;

			goto out;

		}

		err = smb2_set_remote_key_for_rdma(work,

						   (struct smb2_buffer_desc_v1 *)

						   &req->Buffer[0],

						   ((char *)req + ch_offset),

						   req->Channel,

						   req->ReadChannelInfoOffset,

						   req->ReadChannelInfoLength);
@@ -6428,11 +6448,16 @@ int smb2_write(struct ksmbd_work *work) 


	if (req->Channel == SMB2_CHANNEL_RDMA_V1 ||

	    req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE) {

		if (req->Length != 0 || req->DataOffset != 0)

			return -EINVAL;

		unsigned int ch_offset = le16_to_cpu(req->WriteChannelInfoOffset);



		if (req->Length != 0 || req->DataOffset != 0 ||

		    ch_offset < offsetof(struct smb2_write_req, Buffer)) {

			err = -EINVAL;

			goto out;

		}

		err = smb2_set_remote_key_for_rdma(work,

						   (struct smb2_buffer_desc_v1 *)

						   &req->Buffer[0],

						   ((char *)req + ch_offset),

						   req->Channel,

						   req->WriteChannelInfoOffset,

						   req->WriteChannelInfoLength);

fs/ksmbd/smb_common.c

+4 −1
Original line number Diff line number Diff line
@@ -308,14 +308,17 @@ int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level, 
	for (i = 0; i < 2; i++) {

		struct kstat kstat;

		struct ksmbd_kstat ksmbd_kstat;

		struct dentry *dentry;



		if (!dir->dot_dotdot[i]) { /* fill dot entry info */

			if (i == 0) {

				d_info->name = ".";

				d_info->name_len = 1;

				dentry = dir->filp->f_path.dentry;

			} else {

				d_info->name = "..";

				d_info->name_len = 2;

				dentry = dir->filp->f_path.dentry->d_parent;

			}



			if (!match_pattern(d_info->name, d_info->name_len,
@@ -327,7 +330,7 @@ int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level, 
			ksmbd_kstat.kstat = &kstat;

			ksmbd_vfs_fill_dentry_attrs(work,

						    user_ns,

						    dir->filp->f_path.dentry->d_parent,

						    dentry,

						    &ksmbd_kstat);

			rc = fn(conn, info_level, d_info, &ksmbd_kstat);

			if (rc)

fs/ksmbd/transport_rdma.c

+1 −1
Original line number Diff line number Diff line
@@ -80,7 +80,7 @@ static int smb_direct_max_fragmented_recv_size = 1024 * 1024; 
/*  The maximum single-message size which can be received */

static int smb_direct_max_receive_size = 8192;



static int smb_direct_max_read_write_size = 1048512;

static int smb_direct_max_read_write_size = 524224;



static int smb_direct_max_outstanding_rw_ops = 8;