Commit 780bdc1b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag '6.11-rc5-server-fixes' of git://git.samba.org/ksmbd 

Pull smb server fixes from Steve French:

 - query directory flex array fix

 - fix potential null ptr reference in open

 - fix error message in some open cases

 - two minor cleanups

* tag '6.11-rc5-server-fixes' of git://git.samba.org/ksmbd:
  smb/server: update misguided comment of smb2_allocate_rsp_buf()
  smb/server: remove useless assignment of 'file_present' in smb2_open()
  smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
  smb/server: fix return value of smb2_open()
  ksmbd: the buffer of smb2 query dir response has at least 1 byte
parents 48fb4b3d 2b7e0573

fs/smb/server/oplock.c

+1 −1
Original line number Diff line number Diff line
@@ -1510,7 +1510,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) 
 * parse_lease_state() - parse lease context containted in file open request

 * @open_req:	buffer containing smb2 file open(create) request

 *

 * Return:  oplock state, -ENOENT if create lease context not found

 * Return: allocated lease context object on success, otherwise NULL

 */

struct lease_ctx_info *parse_lease_state(void *open_req)

{

fs/smb/server/smb2pdu.c

+9 −9
Original line number Diff line number Diff line
@@ -519,7 +519,7 @@ int init_smb2_rsp_hdr(struct ksmbd_work *work) 
 * smb2_allocate_rsp_buf() - allocate smb2 response buffer

 * @work:	smb work containing smb request buffer

 *

 * Return:      0 on success, otherwise -ENOMEM

 * Return:      0 on success, otherwise error

 */

int smb2_allocate_rsp_buf(struct ksmbd_work *work)

{
@@ -2770,8 +2770,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, 
				}

			}



			if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			     req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) {

			if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			    req_op_level == SMB2_OPLOCK_LEVEL_BATCH) {

				dh_info->CreateGuid =

					durable_v2_blob->CreateGuid;

				dh_info->persistent =
@@ -2791,8 +2791,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, 
				goto out;

			}



			if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			     req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) {

			if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			    req_op_level == SMB2_OPLOCK_LEVEL_BATCH) {

				ksmbd_debug(SMB, "Request for durable open\n");

				dh_info->type = dh_idx;

			}
@@ -3096,7 +3096,6 @@ int smb2_open(struct ksmbd_work *work) 
			goto err_out;

		}



		file_present = true;

		idmap = mnt_idmap(path.mnt);

	} else {

		if (rc != -ENOENT)
@@ -3414,7 +3413,7 @@ int smb2_open(struct ksmbd_work *work) 
			goto err_out1;

		}

	} else {

		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) {

		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) {

			if (S_ISDIR(file_inode(filp)->i_mode)) {

				lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE;

				lc->is_dir = true;
@@ -3713,7 +3712,7 @@ int smb2_open(struct ksmbd_work *work) 
	kfree(name);

	kfree(lc);



	return 0;

	return rc;

}



static int readdir_info_level_struct_sz(int info_level)
@@ -4409,7 +4408,8 @@ int smb2_query_dir(struct ksmbd_work *work) 
		rsp->OutputBufferLength = cpu_to_le32(0);

		rsp->Buffer[0] = 0;

		rc = ksmbd_iov_pin_rsp(work, (void *)rsp,

				       sizeof(struct smb2_query_directory_rsp));

				       offsetof(struct smb2_query_directory_rsp, Buffer)

				       + 1);

		if (rc)

			goto err_out;

	} else {