From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 29 Apr 2019 08:17:31 +0000 (+0200)
Subject: 4.9-stable patches
X-Git-Tag: v4.9.172~49
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=08c4f3c1c0686b48c01b3729a1e36232472e2497;p=thirdparty%2Fkernel%2Fstable-queue.git

4.9-stable patches

added patches:
	cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch
	tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch
---

diff --git a/queue-4.9/cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch b/queue-4.9/cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch
new file mode 100644
index 00000000000..4f6f91e775d
--- /dev/null
+++ b/queue-4.9/cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch
@@ -0,0 +1,38 @@
+From 652727bbe1b17993636346716ae5867627793647 Mon Sep 17 00:00:00 2001
+From: Frank Sorenson <sorenson@redhat.com>
+Date: Tue, 16 Apr 2019 08:37:27 -0500
+Subject: cifs: do not attempt cifs operation on smb2+ rename error
+
+From: Frank Sorenson <sorenson@redhat.com>
+
+commit 652727bbe1b17993636346716ae5867627793647 upstream.
+
+A path-based rename returning EBUSY will incorrectly try opening
+the file with a cifs (NT Create AndX) operation on an smb2+ mount,
+which causes the server to force a session close.
+
+If the mount is smb2+, skip the fallback.
+
+Signed-off-by: Frank Sorenson <sorenson@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/inode.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1722,6 +1722,10 @@ cifs_do_rename(const unsigned int xid, s
+ 	if (rc == 0 || rc != -EBUSY)
+ 		goto do_rename_exit;
+ 
++	/* Don't fall back to using SMB on SMB 2+ mount */
++	if (server->vals->protocol_id != 0)
++		goto do_rename_exit;
++
+ 	/* open-file renames don't work across directories */
+ 	if (to_dentry->d_parent != from_dentry->d_parent)
+ 		goto do_rename_exit;
diff --git a/queue-4.9/series b/queue-4.9/series
index ec92ee65e6a..69b31e5c890 100644
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -1 +1,3 @@
 kbuild-simplify-ld-option-implementation.patch
+cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch
+tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch
diff --git a/queue-4.9/tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch b/queue-4.9/tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch
new file mode 100644
index 00000000000..97f4f488d04
--- /dev/null
+++ b/queue-4.9/tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch
@@ -0,0 +1,52 @@
+From 91862cc7867bba4ee5c8fcf0ca2f1d30427b6129 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Fri, 19 Apr 2019 21:22:59 -0500
+Subject: tracing: Fix a memory leak by early error exit in trace_pid_write()
+
+From: Wenwen Wang <wang6495@umn.edu>
+
+commit 91862cc7867bba4ee5c8fcf0ca2f1d30427b6129 upstream.
+
+In trace_pid_write(), the buffer for trace parser is allocated through
+kmalloc() in trace_parser_get_init(). Later on, after the buffer is used,
+it is then freed through kfree() in trace_parser_put(). However, it is
+possible that trace_pid_write() is terminated due to unexpected errors,
+e.g., ENOMEM. In that case, the allocated buffer will not be freed, which
+is a memory leak bug.
+
+To fix this issue, free the allocated buffer when an error is encountered.
+
+Link: http://lkml.kernel.org/r/1555726979-15633-1-git-send-email-wang6495@umn.edu
+
+Fixes: f4d34a87e9c10 ("tracing: Use pid bitmap instead of a pid array for set_event_pid")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -500,8 +500,10 @@ int trace_pid_write(struct trace_pid_lis
+ 	 * not modified.
+ 	 */
+ 	pid_list = kmalloc(sizeof(*pid_list), GFP_KERNEL);
+-	if (!pid_list)
++	if (!pid_list) {
++		trace_parser_put(&parser);
+ 		return -ENOMEM;
++	}
+ 
+ 	pid_list->pid_max = READ_ONCE(pid_max);
+ 
+@@ -511,6 +513,7 @@ int trace_pid_write(struct trace_pid_lis
+ 
+ 	pid_list->pids = vzalloc((pid_list->pid_max + 7) >> 3);
+ 	if (!pid_list->pids) {
++		trace_parser_put(&parser);
+ 		kfree(pid_list);
+ 		return -ENOMEM;
+ 	}