removed directories in cifs mounted share can still appear within application calls

Bug #317274 reported by Toby Collett
14
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Jaunty
Fix Released
Medium
Manoj Iyer

Bug Description

SRU Justification:

Impact: removed directories in cifs mounted share can still appear within application calls. This could potentially be a security issue?

Fix: A patch from Steve French fixes the problem, [CIFS] revalidate parent inode when rmdir done within that directory

Test: Originator of the bug tested the kernel in http://people.ubuntu.com/~manjo/lp317274-jaunty and reported to work.

---

I found this when updating to subversion 1.5 in hardy backports. Basically a sequence of removing and then confirming a directory has been removed that subversion carries out causes the behaviour. I directory is removed, and then a new readdir call will show the directory is still present.

This has been reported to the samba team and a fix has been comitted to the upstream kernel. Git commit is http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=a3952c2de7f7e76bc84d85e5895f70ca10079cd0

I have confirmed this patch fixes the problem on intrepid and hardy latest kernels. This probably affects earlier kernels but I cannot confirm.

I have attached a test application that triggers the behaviour.

This bug is stopping us using subversion 1.5 on a cifs mount, and I assume will affect any one else wanting to do the same.

ProblemType: Bug
Architecture: amd64
Date: Thu Jan 15 10:47:16 2009
Dependencies:

DistroRelease: Ubuntu 8.04
NonfreeKernelModules: nvidia
Package: linux None [modified: /var/lib/dpkg/info/linux.list]
PackageArchitecture: amd64
ProcEnviron:
 PATH=/usr/local/kicad/linux/:/home/username/.bin/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_NZ.UTF-8
 SHELL=/bin/bhostname
SourcePackage: linux-meta
Uname: Linux 2.6.24-23-generic x86_64

Revision history for this message
Toby Collett (thjc) wrote :
Revision history for this message
Andy Whitcroft (apw) wrote :

This is not a bug in the linux-meta package, moving to the linux package.

affects: linux-meta (Ubuntu) → linux (Ubuntu)
Revision history for this message
Leann Ogasawara (leannogasawara) wrote :

Hi Toby,

This patch looks to already be incorporated into the upcoming kernel for Karmic. I'll open a nomination for Jaunty but leave it to the discretion of the Ubuntu kernel team if it will qualify for a Stable Release Update. Thanks.

Changed in linux (Ubuntu):
status: New → Fix Released
Changed in linux (Ubuntu Jaunty):
importance: Undecided → Medium
status: New → Triaged
Revision history for this message
Leann Ogasawara (leannogasawara) wrote :

Pasting the updated git commit id for reference:

ogasawara@yoji:~/ubuntu-karmic$ git log -p 42c245447c8c3f998dfe880aba18b6e5129d2976
commit 42c245447c8c3f998dfe880aba18b6e5129d2976
Author: Steve French <email address hidden>
Date: Tue Jan 13 22:03:55 2009 +0000

    [CIFS] revalidate parent inode when rmdir done within that directory

Manoj Iyer (manjo)
Changed in linux (Ubuntu Jaunty):
assignee: nobody → Manoj Iyer (manjo)
Revision history for this message
Manoj Iyer (manjo) wrote :

Can you please verify that the kernel in http://people.ubuntu.com/~manjo/lp317274-jaunty fixes the problem, I will submit for SRU Jaunty.

Revision history for this message
Toby Collett (thjc) wrote :

The updated kernel package seems to fix the problem for me, great work.

Stefan Bader (smb)
description: updated
Stefan Bader (smb)
Changed in linux (Ubuntu Jaunty):
status: Triaged → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote :

Accepted linux into jaunty-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags: added: verification-needed
Revision history for this message
Toby Collett (thjc) wrote :

I have tested the jaunty-proposed kernel and it seems to be working fine for me.

Revision history for this message
Martin Pitt (pitti) wrote : Re: [Bug 317274] Re: removed directories in cifs mounted share can still appear within application calls

Toby Collett [2009-07-08 12:31 -0000]:
> I have tested the jaunty-proposed kernel and it seems to be working fine
> for me.

It's not even available yet (2.6.28-14), I'm currently NEWing it.
Could you please test again tomorrow, when the new package will be
available? Thanks!

Revision history for this message
Toby Collett (thjc) wrote :

sorry, enabled proposed and pretty sure I saw a Kernel update so jumped to the wrong conclusion, must have still been running the ppa one. Will test again when package is available :)

Revision history for this message
Toby Collett (thjc) wrote :

Okay, really have the new kernel now (2.6.28-14-generic), seems to be behaving it self in my tests, thanks for pushing the fix through.

Martin Pitt (pitti)
tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (7.2 KiB)

This bug was fixed in the package linux - 2.6.28-15.48

---------------
linux (2.6.28-15.48) jaunty-proposed; urgency=low

  [ Andy Whitcroft ]

  * SAUCE: pnp: add PNP resource range checking function
    - LP: #349314
  * SAUCE: i915: enable MCHBAR if needed
    - LP: #349314

  [ Brad Figg ]

  * SAUCE: Add information to recognize Toshiba Satellite Pro M10 Alps
    Touchpad
    - LP: #330885

  [ Colin Ian King ]

  * Input: atkbd - add forced release keys quirk for Samsung Q45
    - LP: #347623

  [ Manoj Iyer ]

  * SAUCE: Added quirk to enable the installer to recognize NetXen NIC.
    - LP: #389603

  [ Stefan Bader ]

  * SAUCE: input: Blacklist digitizers from joydev.c
    - LP: #300143

  [ Tim Gardner ]

  * Revert "SAUCE: md: wait for possible pending deletes after stopping an
    array"
    - LP: #334994

  [ Upstream Kernel Changes ]

  * bonding: Fix updating of speed/duplex changes
    - LP: #371651
  * net: fix sctp breakage
    - LP: #371651
  * ipv6: don't use tw net when accounting for recycled tw
    - LP: #371651
  * ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c)
    - LP: #371651
  * netfilter: nf_conntrack_tcp: fix unaligned memory access in tcp_sack
    - LP: #371651
  * xfrm: spin_lock() should be spin_unlock() in xfrm_state.c
    - LP: #371651
  * bridge: bad error handling when adding invalid ether address
    - LP: #371651
  * bas_gigaset: correctly allocate USB interrupt transfer buffer
    - LP: #371651
  * USB: EHCI: add software retry for transaction errors
    - LP: #371651
  * USB: fix USB_STORAGE_CYPRESS_ATACB
    - LP: #371651
  * USB: usb-storage: increase max_sectors for tape drives
    - LP: #371651
  * USB: gadget: fix rndis regression
    - LP: #371651
  * USB: add quirk to avoid config and interface strings
    - LP: #371651
  * cifs: fix buffer format byte on NT Rename/hardlink
    - LP: #371651
  * b43: fix b43_plcp_get_bitrate_idx_ofdm return type
    - LP: #371651
  * Add a missing unlock_kernel() in raw_open()
    - LP: #371651
  * x86, PAT, PCI: Change vma prot in pci_mmap to reflect inherited prot
    - LP: #371651
  * security/smack: fix oops when setting a size 0 SMACK64 xattr
    - LP: #371651
  * x86, setup: mark %esi as clobbered in E820 BIOS call
    - LP: #371651
  * dock: fix dereference after kfree()
    - LP: #371651
  * mm: define a UNIQUE value for AS_UNEVICTABLE flag
    - LP: #371651
  * mm: do_xip_mapping_read: fix length calculation
    - LP: #371651
  * vfs: skip I_CLEAR state inodes
    - LP: #371651
  * net/netrom: Fix socket locking
    - LP: #371651
  * kprobes: Fix locking imbalance in kretprobes
    - LP: #371651
  * netfilter: {ip, ip6, arp}_tables: fix incorrect loop detection
    - LP: #371651
  * ALSA: hda - add missing comma in ad1884_slave_vols
    - LP: #371651
  * SCSI: libiscsi: fix iscsi pool error path
    - LP: #371651
  * SCSI: libiscsi: fix iscsi pool error path again
    - LP: #371651
  * posixtimers, sched: Fix posix clock monotonicity
    - LP: #371651
  * sched: do not count frozen tasks toward load
    - LP: #371651
  * spi: spi_write_then_read() bugfixes
    - LP: #371651
  * powerpc: Fix data-corrupting bug in __futex_atomic_op
    - LP...

Read more...

Changed in linux (Ubuntu Jaunty):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.