| Message ID | 20171020124938.9913-3-ddiss@suse.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Looks good. Acked-by: Pavel Shilovsky <pshilov@microsoft.com> Best regards, Pavel Shilovskiy 2017-10-20 5:49 GMT-07:00 David Disseldorp via samba-technical <samba-technical@lists.samba.org>: > An undersize validate negotiate info server response causes the client > to use uninitialised memory for struct validate_negotiate_info_rsp > comparisons of Dialect, SecurityMode and/or Capabilities members. > > Link: https://bugzilla.samba.org/show_bug.cgi?id=13092 > Fixes: 7db0a6efdc3e ("SMB3: Work around mount failure when using SMB3 dialect to Macs") > Signed-off-by: David Disseldorp <ddiss@suse.de> > --- > fs/cifs/smb2pdu.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c > index 052ab5dee6b6..c836de2f79b2 100644 > --- a/fs/cifs/smb2pdu.c > +++ b/fs/cifs/smb2pdu.c > @@ -727,7 +727,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) > rsplen); > > /* relax check since Mac returns max bufsize allowed on ioctl */ > - if (rsplen > CIFSMaxBufSize) > + if ((rsplen > CIFSMaxBufSize) > + || (rsplen < sizeof(struct validate_negotiate_info_rsp))) > goto err_rsp_free; > } > > -- > 2.13.6 > > -- To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 052ab5dee6b6..c836de2f79b2 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -727,7 +727,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) rsplen); /* relax check since Mac returns max bufsize allowed on ioctl */ - if (rsplen > CIFSMaxBufSize) + if ((rsplen > CIFSMaxBufSize) + || (rsplen < sizeof(struct validate_negotiate_info_rsp))) goto err_rsp_free; }
An undersize validate negotiate info server response causes the client to use uninitialised memory for struct validate_negotiate_info_rsp comparisons of Dialect, SecurityMode and/or Capabilities members. Link: https://bugzilla.samba.org/show_bug.cgi?id=13092 Fixes: 7db0a6efdc3e ("SMB3: Work around mount failure when using SMB3 dialect to Macs") Signed-off-by: David Disseldorp <ddiss@suse.de> --- fs/cifs/smb2pdu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)