Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  cifs: remove checks for ses->status == CifsExiting
  cifs: add check for kmalloc in parse_dacl
  cifs: don't send an echo request unless NegProt has been done
  cifs: enable signing flag in SMB header when server has it on
  cifs: Possible slab memory corruption while updating extended stats (repost)
  CIFS: Fix variable types in cifs_iovec_read/write (try #2)
  cifs: fix length vs. total_read confusion in cifs_demultiplex_thread

diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 1e7636b145a88a180c8459f65bf86d51d6c165f6..beeebf194234c4532341eaea45c316fe6cb58c3f 100644 (file)
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -372,6 +372,10 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
 
                ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
                                GFP_KERNEL);
+               if (!ppace) {
+                       cERROR(1, "DACL memory allocation error");
+                       return;
+               }
 
                for (i = 0; i < num_aces; ++i) {
                        ppace[i] = (struct cifs_ace *) (acl_base + acl_size);

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 46c66ed01af43d92a732864cb7b9a76ea6fdd653..904aa47e3515130afdf4d7cf00214e8cfd955b5b 100644 (file)
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -136,9 +136,6 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                }
        }
 
-       if (ses->status == CifsExiting)
-               return -EIO;
-
        /*
         * Give demultiplex thread up to 10 seconds to reconnect, should be
         * greater than cifs socket timeout which is 7 seconds
@@ -156,7 +153,7 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                 * retrying until process is killed or server comes
                 * back on-line
                 */
-               if (!tcon->retry || ses->status == CifsExiting) {
+               if (!tcon->retry) {
                        cFYI(1, "gave up waiting on reconnect in smb_init");
                        return -EHOSTDOWN;
                }

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 47d8ff623683524a4a264e7317a8e707a5a209ed..257b6d895e20d519adcb04ff84de9a3cc5cd93c2 100644 (file)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -337,8 +337,12 @@ cifs_echo_request(struct work_struct *work)
        struct TCP_Server_Info *server = container_of(work,
                                        struct TCP_Server_Info, echo.work);
 
-       /* no need to ping if we got a response recently */
-       if (time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
+       /*
+        * We cannot send an echo until the NEGOTIATE_PROTOCOL request is done.
+        * Also, no need to ping if we got a response recently
+        */
+       if (server->tcpStatus != CifsGood ||
+           time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
                goto requeue_echo;
 
        rc = CIFSSMBEcho(server);
@@ -578,12 +582,12 @@ incomplete_rcv:
                else if (reconnect == 1)
                        continue;
 
-               length += 4; /* account for rfc1002 hdr */
+               total_read += 4; /* account for rfc1002 hdr */
 
-
-               dump_smb(smb_buffer, length);
-               if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
-                       cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
+               dump_smb(smb_buffer, total_read);
+               if (checkSMB(smb_buffer, smb_buffer->Mid, total_read)) {
+                       cifs_dump_mem("Bad SMB: ", smb_buffer,
+                                       total_read < 48 ? total_read : 48);
                        continue;
                }
 
@@ -633,11 +637,11 @@ incomplete_rcv:
                                mid_entry->largeBuf = isLargeBuf;
 multi_t2_fnd:
                                mid_entry->midState = MID_RESPONSE_RECEIVED;
-                               list_del_init(&mid_entry->qhead);
-                               mid_entry->callback(mid_entry);
 #ifdef CONFIG_CIFS_STATS2
                                mid_entry->when_received = jiffies;
 #endif
+                               list_del_init(&mid_entry->qhead);
+                               mid_entry->callback(mid_entry);
                                break;
                        }
                        mid_entry = NULL;

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 74c0a282d012eeb96c3022b1a4616a47f4859636..e964b1cd5dd092bda83d274da53248a50dfd0ba3 100644 (file)
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1662,10 +1662,10 @@ static ssize_t
 cifs_iovec_write(struct file *file, const struct iovec *iov,
                 unsigned long nr_segs, loff_t *poffset)
 {
-       size_t total_written = 0;
-       unsigned int written = 0;
-       unsigned long num_pages, npages;
-       size_t copied, len, cur_len, i;
+       unsigned int written;
+       unsigned long num_pages, npages, i;
+       size_t copied, len, cur_len;
+       ssize_t total_written = 0;
        struct kvec *to_send;
        struct page **pages;
        struct iov_iter it;
@@ -1821,7 +1821,8 @@ cifs_iovec_read(struct file *file, const struct iovec *iov,
 {
        int rc;
        int xid;
-       unsigned int total_read, bytes_read = 0;
+       ssize_t total_read;
+       unsigned int bytes_read = 0;
        size_t len, cur_len;
        int iov_offset = 0;
        struct cifs_sb_info *cifs_sb;

diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b8c5e2eb43d0866d59d293afafc72873867a0e93..fbc5aace54b18dab347af2f624d0686ca8986c9d 100644 (file)
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -359,6 +359,10 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
        if (rc)
                return rc;
 
+       /* enable signing if server requires it */
+       if (server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+               in_buf->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
+
        mutex_lock(&server->srv_mutex);
        mid = AllocMidQEntry(in_buf, server);
        if (mid == NULL) {