Patch "SMB3: Work around mount failure when using SMB3 dialect to Macs" has been added to the 4.11-stable tree

Patch "SMB3: Work around mount failure when using SMB3 dialect to Macs" has been added to the 4.11-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    SMB3: Work around mount failure when using SMB3 dialect to Macs

to the 4.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     smb3-work-around-mount-failure-when-using-smb3-dialect-to-macs.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 7db0a6efdc3e990cdfd4b24820d010e9eb7890ad Mon Sep 17 00:00:00 2001
From: Steve French <smfrench@gmail.com>
Date: Wed, 3 May 2017 21:12:20 -0500
Subject: SMB3: Work around mount failure when using SMB3 dialect to Macs

From: Steve French <smfrench@gmail.com>

commit 7db0a6efdc3e990cdfd4b24820d010e9eb7890ad upstream.

Macs send the maximum buffer size in response on ioctl to validate
negotiate security information, which causes us to fail the mount
as the response buffer is larger than the expected response.

Changed ioctl response processing to allow for padding of validate
negotiate ioctl response and limit the maximum response size to
maximum buffer size.

Signed-off-by: Steve French <steve.french@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2pdu.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -632,8 +632,12 @@ int smb3_validate_negotiate(const unsign
 	}
 
 	if (rsplen != sizeof(struct validate_negotiate_info_rsp)) {
-		cifs_dbg(VFS, "invalid size of protocol negotiate response\n");
-		return -EIO;
+		cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n",
+			 rsplen);
+
+		/* relax check since Mac returns max bufsize allowed on ioctl */
+		if (rsplen > CIFSMaxBufSize)
+			return -EIO;
 	}
 
 	/* check validate negotiate info response matches what we got earlier */
@@ -1853,8 +1857,12 @@ SMB2_ioctl(const unsigned int xid, struc
 	 * than one credit. Windows typically sets this smaller, but for some
 	 * ioctls it may be useful to allow server to send more. No point
 	 * limiting what the server can send as long as fits in one credit
+	 * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
+	 * (by default, note that it can be overridden to make max larger)
+	 * in responses (except for read responses which can be bigger.
+	 * We may want to bump this limit up
 	 */
-	req->MaxOutputResponse = cpu_to_le32(0xFF00); /* < 64K uses 1 credit */
+	req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
 
 	if (is_fsctl)
 		req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);


Patches currently in stable-queue which might be from smfrench@gmail.com are

queue-4.11/cifs-fix-mapping-of-sfm_space-and-sfm_period.patch
queue-4.11/cifs-fix-oplock-break-deadlocks.patch
queue-4.11/cifs-add-misssing-sfm-mapping-for-doublequote.patch
queue-4.11/do-not-return-number-of-bytes-written-for-ioctl-cifs_ioc_copychunk_file.patch
queue-4.11/cifs-fix-cifs_ioc_get_mnt_info-oops.patch
queue-4.11/cifs-fix-cifs_enumerate_snapshots-oops.patch
queue-4.11/fix-match_prepath.patch
queue-4.11/smb3-work-around-mount-failure-when-using-smb3-dialect-to-macs.patch
queue-4.11/cifs-fix-leak-in-fsctl_enum_snaps-response-handling.patch
queue-4.11/set-unicode-flag-on-cifs-echo-request-to-avoid-mac-error.patch