Bug 725370 - cifs: CIFSSMBQAllEAs parses xattr data wrongly
Summary: cifs: CIFSSMBQAllEAs parses xattr data wrongly
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel
Version: 6.2
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Jeff Layton
QA Contact: Jian Li
URL:
Whiteboard:
Depends On:
Blocks: 846522
TreeView+ depends on / blocked
 
Reported: 2011-07-25 10:37 UTC by Jian Li
Modified: 2014-03-04 00:07 UTC (History)
6 users (show)

Fixed In Version: kernel-2.6.32-183.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 846522 (view as bug list)
Environment:
Last Closed: 2011-12-06 13:54:05 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1530 0 normal SHIPPED_LIVE Moderate: Red Hat Enterprise Linux 6 kernel security, bug fix and enhancement update 2011-12-06 01:45:35 UTC

Description Jian Li 2011-07-25 10:37:24 UTC
Description of problem:
When I fetch two(or more) extra attr data from CIFS files using getfattr, I get wrong data. I scan source code(2.6.32-170), find CIFSSMBQAllEAs parse wrongly the data which is returned by SMB messages. 

Test steps:

[root@amd-pike-02 ~]# setfattr -n user.test -v test /mnt/test/test
[root@amd-pike-02 ~]# setfattr -n user.test1 -v test1 /mnt/test/test
[root@amd-pike-02 ~]# setfattr -n user.1test -v 1test /mnt/test/test
[root@amd-pike-02 ~]# getfattr -d /mnt/test/test
getfattr: Removing leading '/' from absolute path names
# file: mnt/test/test
user.1test="1test"
user.security.selinux="unconfined_u:object_r:default_t:s0
user.test="test" 
user.test1="test"   <-----  should be "test1"

[root@amd-pike-02 ~]# getfattr -n user.test1 /mnt/test/test
getfattr: Removing leading '/' from absolute path names
# file: mnt/test/test
user.test1="test"    <------ should be "test1"

Analysis:
[fs/cifs/cifssmb.c]
[5815]
        name_len = temp_fea->name_len;      
<snip>
[5825]
        if (ea_name) {    
            if (strncmp(ea_name, temp_ptr, name_len) == 0) {
           ----ea_name="test1"   temp_ptr="test"  name_len=4
           ----if (ea_name && strnlen(ea_name,0x1000) == name_len)) .....

Comment 2 Jian Li 2011-07-26 00:55:17 UTC
(In reply to comment #0)
> Description of problem:
> When I fetch two(or more) extra attr data from CIFS files using getfattr, I 
Execute, mistake extended attribute with extra attribute

Comment 5 RHEL Program Management 2011-07-26 18:40:16 UTC
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux maintenance release. Product Management has 
requested further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed 
products. This request is not yet committed for inclusion in an Update release.

Comment 6 Jeff Layton 2011-07-26 19:06:38 UTC
Nice catch. Doesn't look too tough to fix -- just need to make sure we match the length of names before the strncmp. I sent a patch upstream to fix this. If it gets pushed for 3.1 in the near future, I'll plan to put this in RHEL6.2.

http://article.gmane.org/gmane.linux.kernel.cifs/3808

Comment 8 Jeff Layton 2011-07-28 16:44:56 UTC
Looks like this patch causes a compiler warning to pop with certain gcc versions (including RHEL6's). I'll respin and re-post.

Comment 10 Kyle McMartin 2011-08-09 12:19:05 UTC
Patch(es) available on kernel-2.6.32-183.el6

Comment 14 Jian Li 2011-08-17 01:56:35 UTC
This bug is tested with case /kernel/filesystems/cifs/xattr

======reproduce
[root@ibm-hs21-01 xattr]# make run
**snip**
< user.test0="test"
**snip**
---
> user.test0="test0"
**snip**
/kernel/filesystems/cifs/xattr result: FAIL
**snip**
[root@ibm-hs21-01 xattr]# uname -a
Linux ibm-hs21-01.rhts.eng.nay.redhat.com 2.6.32-178.el6.x86_64 #1 SMP Wed Aug 3 10:43:13 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

======verify
[root@ibm-hs21-01 xattr]# uname -a
Linux ibm-hs21-01.rhts.eng.nay.redhat.com 2.6.32-188.el6.x86_64 #1 SMP Fri Aug 12 10:22:27 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux
[root@ibm-hs21-01 xattr]# pwd
/mnt/tests/kernel/filesystems/cifs/xattr
[root@ibm-hs21-01 xattr]# make run
**snip**
/kernel/filesystems/cifs/xattr result: SUCCESS
**snip**

Comment 15 errata-xmlrpc 2011-12-06 13:54:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1530.html


Note You need to log in before you can comment on or make changes to this bug.