Attachment 8687 Details for Bug 9130 – git-am fix for master and 4.0.next.

[patch] git-am fix for master and 4.0.next.

bug-9130-4.0.patch (text/plain), 11.77 KB, created by Jeremy Allison on 2013-03-27 00:11:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2013-03-27 00:11:33 UTC

Size: 11.77 KB

patch

obsolete

>From 4a9f093945a4cf75095c78189a053abaa7e8e5b3 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Tue, 26 Mar 2013 15:46:06 -0700
>Subject: [PATCH 1/6] Modify fill_ea_chained_buffer() to be able to do size
> calculation only, no marshalling.
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source3/smbd/trans2.c | 17 ++++++++++-------
> 1 file changed, 10 insertions(+), 7 deletions(-)
>
>diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
>index fae9e1f..135afa7 100644
>--- a/source3/smbd/trans2.c
>+++ b/source3/smbd/trans2.c
>@@ -458,6 +458,7 @@ static NTSTATUS fill_ea_chained_buffer(TALLOC_CTX *mem_ctx,
> {
> 	uint8_t *p = (uint8_t *)pdata;
> 	uint8_t *last_start = NULL;
>+	bool store_data = (pdata != NULL);
> 
> 	*ret_data_size = 0;
> 
>@@ -470,7 +471,7 @@ static NTSTATUS fill_ea_chained_buffer(TALLOC_CTX *mem_ctx,
> 		fstring dos_ea_name;
> 		size_t this_size;
> 
>-		if (last_start) {
>+		if (last_start && store_data) {
> 			SIVAL(last_start, 0, PTR_DIFF(p, last_start));
> 		}
> 		last_start = p;
>@@ -496,12 +497,14 @@ static NTSTATUS fill_ea_chained_buffer(TALLOC_CTX *mem_ctx,
> 		}
> 
> 		/* We know we have room. */
>-		SIVAL(p, 0x00, 0); /* next offset */
>-		SCVAL(p, 0x04, ea_list->ea.flags);
>-		SCVAL(p, 0x05, dos_namelen);
>-		SSVAL(p, 0x06, ea_list->ea.value.length);
>-		strlcpy((char *)(p+0x08), dos_ea_name, dos_namelen+1);
>-		memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
>+		if (store_data) {
>+			SIVAL(p, 0x00, 0); /* next offset */
>+			SCVAL(p, 0x04, ea_list->ea.flags);
>+			SCVAL(p, 0x05, dos_namelen);
>+			SSVAL(p, 0x06, ea_list->ea.value.length);
>+			strlcpy((char *)(p+0x08), dos_ea_name, dos_namelen+1);
>+			memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
>+		}
> 
> 		total_data_size -= this_size;
> 		p += this_size;
>-- 
>1.8.1.3
>
>
>From 83f33145fe50abccd4976ee66e31db59dfae642a Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Tue, 26 Mar 2013 15:54:31 -0700
>Subject: [PATCH 2/6] Change estimate_ea_size() to correctly estimate the EA
> size over SMB2.
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source3/smbd/trans2.c | 20 ++++++++++++++++++++
> 1 file changed, 20 insertions(+)
>
>diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
>index 135afa7..032d038 100644
>--- a/source3/smbd/trans2.c
>+++ b/source3/smbd/trans2.c
>@@ -534,6 +534,26 @@ static unsigned int estimate_ea_size(connection_struct *conn, files_struct *fsp,
> 		fsp = NULL;
> 	}
> 	(void)get_ea_list_from_file_path(mem_ctx, conn, fsp, smb_fname->base_name, &total_ea_len, &ea_list);
>+	if(conn->sconn->using_smb2) {
>+		NTSTATUS status;
>+		unsigned int ret_data_size;
>+		/*
>+		 * We're going to be using fill_ea_chained_buffer() to
>+		 * marshall EA's - this size is significantly larger
>+		 * than the SMB1 buffer. Re-calculate the size without
>+		 * marshalling.
>+		 */
>+		status = fill_ea_chained_buffer(mem_ctx,
>+						NULL,
>+						65535,
>+						&ret_data_size,
>+						conn,
>+						ea_list);
>+		if (!NT_STATUS_IS_OK(status)) {
>+			ret_data_size = 0;
>+		}
>+		total_ea_len = ret_data_size;
>+	}
> 	TALLOC_FREE(mem_ctx);
> 	return total_ea_len;
> }
>-- 
>1.8.1.3
>
>
>From a202e7ab6707cba4a8eef97bd0b1bc9fae3d4bc3 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Tue, 26 Mar 2013 16:37:22 -0700
>Subject: [PATCH 3/6] Fix bug #9130 - Certain xattrs cause Windows error
> 0x800700FF
>
>Ensure we never return any zero-length EA's.
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source3/smbd/trans2.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
>diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
>index 032d038..0811484 100644
>--- a/source3/smbd/trans2.c
>+++ b/source3/smbd/trans2.c
>@@ -357,6 +357,15 @@ static NTSTATUS get_ea_list_from_file_path(TALLOC_CTX *mem_ctx, connection_struc
> 			return status;
> 		}
> 
>+		if (listp->ea.value.length == 0) {
>+			/*
>+			 * We can never return a zero length EA.
>+			 * Windows reports the EA's as corrupted.
>+			 */
>+			TALLOC_FREE(listp);
>+			continue;
>+		}
>+
> 		push_ascii_fstring(dos_ea_name, listp->ea.name);
> 
> 		*pea_total_len +=
>-- 
>1.8.1.3
>
>
>From 837ea5f62f780d5ca1e1eec441933f3e92bd034e Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Tue, 26 Mar 2013 16:38:00 -0700
>Subject: [PATCH 4/6] Fix bug #9130 - Certain xattrs cause Windows error
> 0x800700FF
>
>Ensure ntvfs server never returns zero length EA's.
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source4/ntvfs/posix/pvfs_qfileinfo.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/source4/ntvfs/posix/pvfs_qfileinfo.c b/source4/ntvfs/posix/pvfs_qfileinfo.c
>index ac3e6a6..dbf8384 100644
>--- a/source4/ntvfs/posix/pvfs_qfileinfo.c
>+++ b/source4/ntvfs/posix/pvfs_qfileinfo.c
>@@ -102,6 +102,9 @@ NTSTATUS pvfs_query_ea_list(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
> 		for (j=0;j<ealist->num_eas;j++) {
> 			if (strcasecmp_m(eas->eas[i].name.s, 
> 				       ealist->eas[j].name) == 0) {
>+				if (ealist->eas[i].value.length == 0) {
>+					continue;
>+				}
> 				eas->eas[i].value = ealist->eas[j].value;
> 				break;
> 			}
>@@ -134,6 +137,9 @@ static NTSTATUS pvfs_query_all_eas(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
> 	for (i=0;i<ealist->num_eas;i++) {
> 		eas->eas[eas->num_eas].flags = 0;
> 		eas->eas[eas->num_eas].name.s = ealist->eas[i].name;
>+		if (ealist->eas[i].value.length == 0) {
>+			continue;
>+		}
> 		eas->eas[eas->num_eas].value = ealist->eas[i].value;
> 		eas->num_eas++;
> 	}
>-- 
>1.8.1.3
>
>
>From bc6a6818fcf81c2c9c23329a908656c519341cf4 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Tue, 26 Mar 2013 13:26:49 -0700
>Subject: [PATCH 5/6] Add a test to show that zero-length EA's are never
> returned over SMB2.
>
>Zero length EA's only delete an EA, never store. Proves we should
>never return zero-length EA's even if they have been set on the
>POSIX side.
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source4/torture/smb2/setinfo.c | 121 +++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 121 insertions(+)
>
>diff --git a/source4/torture/smb2/setinfo.c b/source4/torture/smb2/setinfo.c
>index 719e8f0..fee7293 100644
>--- a/source4/torture/smb2/setinfo.c
>+++ b/source4/torture/smb2/setinfo.c
>@@ -30,6 +30,36 @@
> #include "libcli/security/security.h"
> #include "librpc/gen_ndr/ndr_security.h"
> 
>+static bool find_returned_ea(union smb_fileinfo *finfo2,
>+				const char *eaname,
>+				const char *eavalue)
>+{
>+	unsigned int i;
>+	unsigned int num_eas = finfo2->all_eas.out.num_eas;
>+	struct ea_struct *eas = finfo2->all_eas.out.eas;
>+
>+	for (i = 0; i < num_eas; i++) {
>+		if (eas[i].name.s == NULL) {
>+			continue;
>+		}
>+		/* Windows capitalizes returned EA names. */
>+		if (strcasecmp_m(eas[i].name.s, eaname)) {
>+			continue;
>+		}
>+		if (eavalue == NULL && eas[i].value.length == 0) {
>+			/* Null value, found it ! */
>+			return true;
>+		}
>+		if (eas[i].value.length == strlen(eavalue) &&
>+				memcmp(eas[i].value.data,
>+					eavalue,
>+					strlen(eavalue)) == 0) {
>+			return true;
>+		}
>+	}
>+	return false;
>+}
>+
> #define BASEDIR ""
> 
> #define FAIL_UNLESS(__cond)					\
>@@ -60,6 +90,7 @@ bool torture_smb2_setinfo(struct torture_context *tctx)
> 	const char *call_name;
> 	time_t basetime = (time(NULL) - 86400) & ~1;
> 	int n = time(NULL) % 100;
>+	struct ea_struct ea;
> 	
> 	ZERO_STRUCT(handle);
> 	
>@@ -276,6 +307,96 @@ bool torture_smb2_setinfo(struct torture_context *tctx)
> 	CHECK_CALL(SEC_DESC, NT_STATUS_OK);
> 	FAIL_UNLESS(smb2_util_verify_sd(tctx, tree, handle, sd));
> 
>+	torture_comment(tctx, "Check zero length EA's behavior\n");
>+
>+	/* Set a new EA. */
>+	sfinfo.full_ea_information.in.eas.num_eas = 1;
>+	ea.flags = 0;
>+	ea.name.private_length = 6;
>+	ea.name.s = "NewEA";
>+	ea.value = data_blob_string_const("testme");
>+	sfinfo.full_ea_information.in.eas.eas = &ea;
>+	CHECK_CALL(FULL_EA_INFORMATION, NT_STATUS_OK);
>+
>+	/* Does it still exist ? */
>+	finfo2.generic.level = RAW_FILEINFO_SMB2_ALL_EAS;
>+	finfo2.generic.in.file.handle = handle;
>+	finfo2.all_eas.in.continue_flags = 1;
>+	status2 = smb2_getinfo_file(tree, tctx, &finfo2);
>+	if (!NT_STATUS_IS_OK(status2)) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) %s - %s\n", __location__,
>+			"SMB2_ALL_EAS", nt_errstr(status2));
>+		ret = false;
>+		goto done;
>+	}
>+
>+	/* Note on Windows EA name is returned capitalized. */
>+	if (!find_returned_ea(&finfo2, "NewEA", "testme")) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) Missing EA 'NewEA'\n", __location__);
>+		ret = false;
>+	}
>+
>+	/* Now zero it out (should delete it) */
>+	sfinfo.full_ea_information.in.eas.num_eas = 1;
>+	ea.flags = 0;
>+	ea.name.private_length = 6;
>+	ea.name.s = "NewEA";
>+	ea.value = data_blob_null;
>+	sfinfo.full_ea_information.in.eas.eas = &ea;
>+	CHECK_CALL(FULL_EA_INFORMATION, NT_STATUS_OK);
>+
>+	/* Does it still exist ? */
>+	finfo2.generic.level = RAW_FILEINFO_SMB2_ALL_EAS;
>+	finfo2.generic.in.file.handle = handle;
>+	finfo2.all_eas.in.continue_flags = 1;
>+	status2 = smb2_getinfo_file(tree, tctx, &finfo2);
>+	if (!NT_STATUS_IS_OK(status2)) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) %s - %s\n", __location__,
>+			"SMB2_ALL_EAS", nt_errstr(status2));
>+		ret = false;
>+		goto done;
>+	}
>+
>+	if (find_returned_ea(&finfo2, "NewEA", NULL)) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) EA 'NewEA' should be deleted\n", __location__);
>+		ret = false;
>+	}
>+
>+	/* Set a zero length EA. */
>+	sfinfo.full_ea_information.in.eas.num_eas = 1;
>+	ea.flags = 0;
>+	ea.name.private_length = 6;
>+	ea.name.s = "ZeroEA";
>+	ea.value = data_blob_null;
>+	sfinfo.full_ea_information.in.eas.eas = &ea;
>+	CHECK_CALL(FULL_EA_INFORMATION, NT_STATUS_OK);
>+
>+	/* Does it still exist ? */
>+	finfo2.generic.level = RAW_FILEINFO_SMB2_ALL_EAS;
>+	finfo2.generic.in.file.handle = handle;
>+	finfo2.all_eas.in.continue_flags = 1;
>+	status2 = smb2_getinfo_file(tree, tctx, &finfo2);
>+	if (!NT_STATUS_IS_OK(status2)) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) %s - %s\n", __location__,
>+			"SMB2_ALL_EAS", nt_errstr(status2));
>+		ret = false;
>+		goto done;
>+	}
>+
>+	/* Over SMB2 ZeroEA should not exist. */
>+	if (!find_returned_ea(&finfo2, "EAONE", "VALUE1")) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) Missing EA 'EAONE'\n", __location__);
>+		ret = false;
>+	}
>+	if (!find_returned_ea(&finfo2, "SECONDEA", "ValueTwo")) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) Missing EA 'SECONDEA'\n", __location__);
>+		ret = false;
>+	}
>+	if (find_returned_ea(&finfo2, "ZeroEA", NULL)) {
>+		torture_result(tctx, TORTURE_FAIL, "(%s) Found null EA 'ZeroEA'\n", __location__);
>+		ret = false;
>+	}
>+
> done:
> 	status = smb2_util_close(tree, handle);
> 	if (NT_STATUS_IS_ERR(status)) {
>-- 
>1.8.1.3
>
>
>From 9d90f64f8c137d51881a0aa227b8be357296f313 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Tue, 26 Mar 2013 16:46:51 -0700
>Subject: [PATCH 6/6] Ensure we don't return uninitialized memory in the pad
> bytes.
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source3/smbd/trans2.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
>diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
>index 0811484..eff8db7 100644
>--- a/source3/smbd/trans2.c
>+++ b/source3/smbd/trans2.c
>@@ -479,6 +479,7 @@ static NTSTATUS fill_ea_chained_buffer(TALLOC_CTX *mem_ctx,
> 		size_t dos_namelen;
> 		fstring dos_ea_name;
> 		size_t this_size;
>+		size_t pad = 0;
> 
> 		if (last_start && store_data) {
> 			SIVAL(last_start, 0, PTR_DIFF(p, last_start));
>@@ -497,7 +498,7 @@ static NTSTATUS fill_ea_chained_buffer(TALLOC_CTX *mem_ctx,
> 		this_size = 0x08 + dos_namelen + 1 + ea_list->ea.value.length;
> 
> 		if (ea_list->next) {
>-			size_t pad = 4 - (this_size % 4);
>+			pad = 4 - (this_size % 4);
> 			this_size += pad;
> 		}
> 
>@@ -513,6 +514,11 @@ static NTSTATUS fill_ea_chained_buffer(TALLOC_CTX *mem_ctx,
> 			SSVAL(p, 0x06, ea_list->ea.value.length);
> 			strlcpy((char *)(p+0x08), dos_ea_name, dos_namelen+1);
> 			memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
>+			if (pad) {
>+				memset(p + 0x08 + dos_namelen + 1 + ea_list->ea.value.length,
>+					'\0',
>+					pad);
>+			}
> 		}
> 
> 		total_data_size -= this_size;
>-- 
>1.8.1.3
>

Actions: View

Attachments on bug 9130: 7855 | 8668 | 8669 | 8685 | 8686 | 8687 | 8688 | 8690 | 8691 | 8696 | 8699 | 8701 | 8719 | 8733