linux-kernel - Linux-2.6.31-rc8 inotify hangs samba clients [UPDATED]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0908290014470.19623@boston.corp.fedex.com>
Date:	Sat, 29 Aug 2009 00:21:51 +0800 (SGT)
From:	Jeff Chua <jeff.chua.linux@...il.com>
To:	"Eric W. Biederman" <ebiederm@...stanetworks.com>,
	Eric Paris <eparis@...hat.com>
cc:	Linux Kernel <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Linux-2.6.31-rc8 inotify hangs samba clients [UPDATED]



Sorry, corrected patch below. Previous one was bad ... I was 
messing with.

The first part of commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd hangs 
WinXP clients browsing Linux samba folders ... trying to add a terminating 
byte to name_len. Reverting this solves the problem.

The second part of adding zeros is fine.

If we don't revert here, then Samba 3.3.7 will have to change to work with 
Linux 2.6.31-rc8, and perhaps other codes as well.

Thanks,
Jeff


Here the patch to revert.


commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd
Author: Eric W. Biederman <ebiederm@...ssion.com>
Date:   Thu Aug 27 03:20:04 2009 -0700

     inotify: Ensure we alwasy write the terminating NULL.

     Before the rewrite copy_event_to_user always wrote a terqminating '\0'
     byte to user space after the filename.  Since the rewrite that
     terminating byte was skipped if your filename is exactly a multiple of
     event_size.  Ouch!

     So add one byte to name_size before we round up and use clear_user to
     set userspace to zero like /dev/zero does instead of copying the
     strange nul_inotify_event.

     Signed-off-by: Eric W. Biederman <ebiederm@...stanetworks.com>
     Signed-off-by: Eric Paris <eparis@...hat.com>

diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index ce1f582..0e781bc 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -199,8 +196,10 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
  		inotify_free_event_priv(fsn_priv);
  	}

-	/* round up event->name_len so it is a multiple of event_size */
-	name_len = roundup(event->name_len, event_size);
+	/* round up event->name_len so it is a multiple of event_size
+	 * plus an extra byte for the terminating '\0'.
+	 */
+	name_len = roundup(event->name_len + 1, event_size);
  	inotify_event.len = name_len;

  	inotify_event.mask = inotify_mask_to_arg(event->mask);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/