Merge tag '5.11-rc-smb3' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs updates from Steve French:
 "The largest part are for support of the newer mount API which has been
  needed for cifs/smb3 mounts for a long time due to the new API's
  better handling of remount, and better error reporting. There are
  three additional small cleanup patches for this being tested, that are
  not included yet.

  This series also includes addition of support for the SMB3 witness
  protocol which can provide important notifications from the server to
  client on server address or export or network changes. This can be
  useful for example in order to be notified before the failure - when a
  server's IP address changes (in the future it will allow us to support
  server notifications of when a share is moved).

  It also includes three patches for stable e.g. some that better handle
  some confusing error messages during session establishment"

* tag '5.11-rc-smb3' of git://git.samba.org/sfrench/cifs-2.6: (55 commits)
  cifs: update internal module version number
  cifs: Fix support for remount when not changing rsize/wsize
  cifs: handle "guest" mount parameter
  cifs: correct four aliased mount parms to allow use of previous names
  cifs: Tracepoints and logs for tracing credit changes.
  cifs: fix use after free in cifs_smb3_do_mount()
  cifs: fix rsize/wsize to be negotiated values
  cifs: Fix some error pointers handling detected by static checker
  smb3: remind users that witness protocol is experimental
  cifs: update super_operations to show_devname
  cifs: fix uninitialized variable in smb3_fs_context_parse_param
  cifs: update mnt_cifs_flags during reconfigure
  cifs: move update of flags into a separate function
  cifs: remove ctx argument from cifs_setup_cifs_sb
  cifs: do not allow changing posix_paths during remount
  cifs: uncomplicate printing the iocharset parameter
  cifs: don't create a temp nls in cifs_setup_ipc
  cifs: simplify handling of cifs_sb/ctx->local_nls
  cifs: we do not allow changing username/password/unc/... during remount
  cifs: add initial reconfigure support
  ...

1 files changed, 26 insertions, 5 deletions

diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index d88e2683626e..60d4bd1eae2b 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -94,6 +94,8 @@ static const __le16 smb2_rsp_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
 	/* SMB2_OPLOCK_BREAK */ cpu_to_le16(24)
 };
 
+#define SMB311_NEGPROT_BASE_SIZE (sizeof(struct smb2_sync_hdr) + sizeof(struct smb2_negotiate_rsp))
+
 static __u32 get_neg_ctxt_len(struct smb2_sync_hdr *hdr, __u32 len,
 			      __u32 non_ctxlen)
 {
@@ -107,13 +109,28 @@ static __u32 get_neg_ctxt_len(struct smb2_sync_hdr *hdr, __u32 len,
 	   (pneg_rsp->DialectRevision != cpu_to_le16(SMB311_PROT_ID)))
 		return 0;
 
-	/* Make sure that negotiate contexts start after gss security blob */
+	/*
+	 * if SPNEGO blob present (ie the RFC2478 GSS info which indicates
+	 * which security mechanisms the server supports) make sure that
+	 * the negotiate contexts start after it
+	 */
 	nc_offset = le32_to_cpu(pneg_rsp->NegotiateContextOffset);
-	if (nc_offset < non_ctxlen) {
-		pr_warn_once("Invalid negotiate context offset\n");
+	/*
+	 * non_ctxlen is at least shdr->StructureSize + pdu->StructureSize2
+	 * and the latter is 1 byte bigger than the fix-sized area of the
+	 * NEGOTIATE response
+	 */
+	if (nc_offset + 1 < non_ctxlen) {
+		pr_warn_once("Invalid negotiate context offset %d\n", nc_offset);
 		return 0;
-	}
-	size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen;
+	} else if (nc_offset + 1 == non_ctxlen) {
+		cifs_dbg(FYI, "no SPNEGO security blob in negprot rsp\n");
+		size_of_pad_before_neg_ctxts = 0;
+	} else if (non_ctxlen == SMB311_NEGPROT_BASE_SIZE)
+		/* has padding, but no SPNEGO blob */
+		size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen + 1;
+	else
+		size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen;
 
 	/* Verify that at least minimal negotiate contexts fit within frame */
 	if (len < nc_offset + (neg_count * sizeof(struct smb2_neg_context))) {
@@ -859,6 +876,10 @@ smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server)
  *
  * Assumes @iov does not contain the rfc1002 length and iov[0] has the
  * SMB2 header.
+ *
+ * @ses:	server session structure
+ * @iov:	array containing the SMB request we will send to the server
+ * @nvec:	number of array entries for the iov
  */
 int
 smb311_update_preauth_hash(struct cifs_ses *ses, struct kvec *iov, int nvec)