From: Greg Kroah-Hartman Date: Mon, 29 Apr 2019 08:18:04 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.9.172~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e58c2d8c1a09cabe5cd9827bd26cfeedade281b2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch cifs-fix-memory-leak-in-smb2_read.patch tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch --- diff --git a/queue-4.19/cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch b/queue-4.19/cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch new file mode 100644 index 00000000000..1202583ac93 --- /dev/null +++ b/queue-4.19/cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch @@ -0,0 +1,38 @@ +From 652727bbe1b17993636346716ae5867627793647 Mon Sep 17 00:00:00 2001 +From: Frank Sorenson +Date: Tue, 16 Apr 2019 08:37:27 -0500 +Subject: cifs: do not attempt cifs operation on smb2+ rename error + +From: Frank Sorenson + +commit 652727bbe1b17993636346716ae5867627793647 upstream. + +A path-based rename returning EBUSY will incorrectly try opening +the file with a cifs (NT Create AndX) operation on an smb2+ mount, +which causes the server to force a session close. + +If the mount is smb2+, skip the fallback. + +Signed-off-by: Frank Sorenson +Signed-off-by: Steve French +CC: Stable +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/inode.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1735,6 +1735,10 @@ cifs_do_rename(const unsigned int xid, s + if (rc == 0 || rc != -EBUSY) + goto do_rename_exit; + ++ /* Don't fall back to using SMB on SMB 2+ mount */ ++ if (server->vals->protocol_id != 0) ++ goto do_rename_exit; ++ + /* open-file renames don't work across directories */ + if (to_dentry->d_parent != from_dentry->d_parent) + goto do_rename_exit; diff --git a/queue-4.19/cifs-fix-memory-leak-in-smb2_read.patch b/queue-4.19/cifs-fix-memory-leak-in-smb2_read.patch new file mode 100644 index 00000000000..9884bae6050 --- /dev/null +++ b/queue-4.19/cifs-fix-memory-leak-in-smb2_read.patch @@ -0,0 +1,33 @@ +From 05fd5c2c61732152a6bddc318aae62d7e436629b Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Tue, 23 Apr 2019 16:39:45 +1000 +Subject: cifs: fix memory leak in SMB2_read + +From: Ronnie Sahlberg + +commit 05fd5c2c61732152a6bddc318aae62d7e436629b upstream. + +Commit 088aaf17aa79300cab14dbee2569c58cfafd7d6e introduced a leak where +if SMB2_read() returned an error we would return without freeing the +request buffer. + +Cc: Stable +Signed-off-by: Ronnie Sahlberg +Reviewed-by: Pavel Shilovsky +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3285,6 +3285,7 @@ SMB2_read(const unsigned int xid, struct + rc); + } + free_rsp_buf(resp_buftype, rsp_iov.iov_base); ++ cifs_small_buf_release(req); + return rc == -ENODATA ? 0 : rc; + } else + trace_smb3_read_done(xid, req->PersistentFileId, diff --git a/queue-4.19/series b/queue-4.19/series index c216b791e15..2a362bd6821 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -20,3 +20,6 @@ ipvs-fix-warning-on-unused-variable.patch powerpc-vdso32-fix-clock_monotonic-on-ppc64.patch alsa-hda-ca0132-fix-build-error-without-config_pci.patch net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_.patch +cifs-fix-memory-leak-in-smb2_read.patch +cifs-do-not-attempt-cifs-operation-on-smb2-rename-error.patch +tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch diff --git a/queue-4.19/tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch b/queue-4.19/tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch new file mode 100644 index 00000000000..db2db6c33dd --- /dev/null +++ b/queue-4.19/tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch @@ -0,0 +1,52 @@ +From 91862cc7867bba4ee5c8fcf0ca2f1d30427b6129 Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Fri, 19 Apr 2019 21:22:59 -0500 +Subject: tracing: Fix a memory leak by early error exit in trace_pid_write() + +From: Wenwen Wang + +commit 91862cc7867bba4ee5c8fcf0ca2f1d30427b6129 upstream. + +In trace_pid_write(), the buffer for trace parser is allocated through +kmalloc() in trace_parser_get_init(). Later on, after the buffer is used, +it is then freed through kfree() in trace_parser_put(). However, it is +possible that trace_pid_write() is terminated due to unexpected errors, +e.g., ENOMEM. In that case, the allocated buffer will not be freed, which +is a memory leak bug. + +To fix this issue, free the allocated buffer when an error is encountered. + +Link: http://lkml.kernel.org/r/1555726979-15633-1-git-send-email-wang6495@umn.edu + +Fixes: f4d34a87e9c10 ("tracing: Use pid bitmap instead of a pid array for set_event_pid") +Cc: stable@vger.kernel.org +Signed-off-by: Wenwen Wang +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -496,8 +496,10 @@ int trace_pid_write(struct trace_pid_lis + * not modified. + */ + pid_list = kmalloc(sizeof(*pid_list), GFP_KERNEL); +- if (!pid_list) ++ if (!pid_list) { ++ trace_parser_put(&parser); + return -ENOMEM; ++ } + + pid_list->pid_max = READ_ONCE(pid_max); + +@@ -507,6 +509,7 @@ int trace_pid_write(struct trace_pid_lis + + pid_list->pids = vzalloc((pid_list->pid_max + 7) >> 3); + if (!pid_list->pids) { ++ trace_parser_put(&parser); + kfree(pid_list); + return -ENOMEM; + }