From: Greg Kroah-Hartman Date: Sun, 23 Jun 2019 20:11:43 +0000 (+0200) Subject: drop cifs patch from 4.19 and 5.1 X-Git-Tag: v5.1.15~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=483120eae6cc616a7d3045b6a07d25de9396b5d1;p=thirdparty%2Fkernel%2Fstable-queue.git drop cifs patch from 4.19 and 5.1 --- diff --git a/queue-4.19/cifs-fix-panic-in-smb2_reconnect.patch b/queue-4.19/cifs-fix-panic-in-smb2_reconnect.patch deleted file mode 100644 index 9c049396bda..00000000000 --- a/queue-4.19/cifs-fix-panic-in-smb2_reconnect.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 0ff2b018b02f89da26a616e0148582321a00fd99 Mon Sep 17 00:00:00 2001 -From: Ronnie Sahlberg -Date: Wed, 5 Jun 2019 10:15:34 +1000 -Subject: cifs: fix panic in smb2_reconnect - -From: Ronnie Sahlberg - -commit 0ff2b018b02f89da26a616e0148582321a00fd99 upstream. - -RH Bugzilla: 1702264 - -We need to protect so that the call to smb2_reconnect() in -smb2_reconnect_server() does not end up freeing the session -because it can lead to a use after free and crash. - -Reviewed-by: Aurelien Aptel -Cc: -Signed-off-by: Ronnie Sahlberg -Signed-off-by: Steve French -Reviewed-by: Pavel Shilovsky -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/smb2pdu.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -2869,9 +2869,14 @@ void smb2_reconnect_server(struct work_s - tcon_exist = true; - } - } -+ /* -+ * IPC has the same lifetime as its session and uses its -+ * refcount. -+ */ - if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { - list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); - tcon_exist = true; -+ ses->ses_count++; - } - } - /* -@@ -2890,7 +2895,10 @@ void smb2_reconnect_server(struct work_s - else - resched = true; - list_del_init(&tcon->rlist); -- cifs_put_tcon(tcon); -+ if (tcon->ipc) -+ cifs_put_smb_ses(tcon->ses); -+ else -+ cifs_put_tcon(tcon); - } - - cifs_dbg(FYI, "Reconnecting tcons finished\n"); diff --git a/queue-4.19/series b/queue-4.19/series index e2ed50dedaa..9b8a91ecf61 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -17,7 +17,6 @@ scsi-ufs-avoid-runtime-suspend-possibly-being-blocked-forever.patch usb-chipidea-udc-workaround-for-endpoint-conflict-issue.patch xhci-detect-usb-3.2-capable-host-controllers-correctly.patch usb-xhci-don-t-try-to-recover-an-endpoint-if-port-is-in-error-state.patch -cifs-fix-panic-in-smb2_reconnect.patch ib-hfi1-validate-fault-injection-opcode-user-input.patch ib-hfi1-silence-txreq-allocation-warnings.patch iio-temperature-mlx90632-relax-the-compatibility-check.patch diff --git a/queue-5.1/cifs-fix-panic-in-smb2_reconnect.patch b/queue-5.1/cifs-fix-panic-in-smb2_reconnect.patch deleted file mode 100644 index 999e18a2638..00000000000 --- a/queue-5.1/cifs-fix-panic-in-smb2_reconnect.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 0ff2b018b02f89da26a616e0148582321a00fd99 Mon Sep 17 00:00:00 2001 -From: Ronnie Sahlberg -Date: Wed, 5 Jun 2019 10:15:34 +1000 -Subject: cifs: fix panic in smb2_reconnect - -From: Ronnie Sahlberg - -commit 0ff2b018b02f89da26a616e0148582321a00fd99 upstream. - -RH Bugzilla: 1702264 - -We need to protect so that the call to smb2_reconnect() in -smb2_reconnect_server() does not end up freeing the session -because it can lead to a use after free and crash. - -Reviewed-by: Aurelien Aptel -Cc: -Signed-off-by: Ronnie Sahlberg -Signed-off-by: Steve French -Reviewed-by: Pavel Shilovsky -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/smb2pdu.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -3049,9 +3049,14 @@ void smb2_reconnect_server(struct work_s - tcon_exist = true; - } - } -+ /* -+ * IPC has the same lifetime as its session and uses its -+ * refcount. -+ */ - if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { - list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); - tcon_exist = true; -+ ses->ses_count++; - } - } - /* -@@ -3070,7 +3075,10 @@ void smb2_reconnect_server(struct work_s - else - resched = true; - list_del_init(&tcon->rlist); -- cifs_put_tcon(tcon); -+ if (tcon->ipc) -+ cifs_put_smb_ses(tcon->ses); -+ else -+ cifs_put_tcon(tcon); - } - - cifs_dbg(FYI, "Reconnecting tcons finished\n"); diff --git a/queue-5.1/series b/queue-5.1/series index 58e126ddd05..00b8ec35588 100644 --- a/queue-5.1/series +++ b/queue-5.1/series @@ -10,7 +10,6 @@ scsi-ufs-avoid-runtime-suspend-possibly-being-blocked-forever.patch usb-chipidea-udc-workaround-for-endpoint-conflict-issue.patch xhci-detect-usb-3.2-capable-host-controllers-correctly.patch usb-xhci-don-t-try-to-recover-an-endpoint-if-port-is-in-error-state.patch -cifs-fix-panic-in-smb2_reconnect.patch cifs-add-spinlock-for-the-openfilelist-to-cifsinodeinfo.patch cifs-fix-globalmid_lock-bug-in-cifs_reconnect.patch ib-hfi1-validate-fault-injection-opcode-user-input.patch