diff mbox

CIFS: Fix possible freed pointer dereference in CIFS_SessSetup

Message ID 1348556409-10339-2-git-send-email-piastry@etersoft.ru (mailing list archive)
State New, archived
Headers show

Commit Message

Pavel Shilovsky Sept. 25, 2012, 7 a.m. UTC
Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru>
---
 fs/cifs/sess.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

Comments

Steve French Sept. 27, 2012, 3:16 a.m. UTC | #1
merged into cifs-2.6.git (along with the other two in this series)

On Tue, Sep 25, 2012 at 2:00 AM, Pavel Shilovsky <piastry@etersoft.ru> wrote:
> Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru>
> ---
>  fs/cifs/sess.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
> index 382c06d..76809f4 100644
> --- a/fs/cifs/sess.c
> +++ b/fs/cifs/sess.c
> @@ -876,7 +876,8 @@ ssetup_ntlmssp_authenticate:
>         pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base;
>         smb_buf = (struct smb_hdr *)iov[0].iov_base;
>
> -       if ((type == RawNTLMSSP) && (smb_buf->Status.CifsError ==
> +       if ((type == RawNTLMSSP) && (resp_buf_type != CIFS_NO_BUFFER) &&
> +           (smb_buf->Status.CifsError ==
>                         cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))) {
>                 if (phase != NtLmNegotiate) {
>                         cERROR(1, "Unexpected more processing error");
Pavel Shilovsky Sept. 27, 2012, 8:17 a.m. UTC | #2
2012/9/27 Steve French <smfrench@gmail.com>:
> merged into cifs-2.6.git (along with the other two in this

What do you think about Cc'ing it to stable@vger.kernel.org as well?
Steve French Sept. 30, 2012, 11:54 p.m. UTC | #3
On Thu, Sep 27, 2012 at 3:17 AM, Pavel Shilovsky <piastry@etersoft.ru> wrote:
> 2012/9/27 Steve French <smfrench@gmail.com>:
>> merged into cifs-2.6.git (along with the other two in this
>
> What do you think about Cc'ing it to stable@vger.kernel.org as well?

I don't think it is necessary but if you think a problem is
reproducible let me know.  In the case where

           resp_buf_type == CIFS_NO_BUFFER

then we have iov pointing to the original request and therefore

    smb_buf->Status.CifsError ==
                        cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED

will never be true  Your code (adding the check for resp_buf_type)
makes it cleaner and better, but  I don't see how we can end up
oopsing or falling into this section of code accidentally with the
previous version.
diff mbox

Patch

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 382c06d..76809f4 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -876,7 +876,8 @@  ssetup_ntlmssp_authenticate:
 	pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base;
 	smb_buf = (struct smb_hdr *)iov[0].iov_base;
 
-	if ((type == RawNTLMSSP) && (smb_buf->Status.CifsError ==
+	if ((type == RawNTLMSSP) && (resp_buf_type != CIFS_NO_BUFFER) &&
+	    (smb_buf->Status.CifsError ==
 			cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))) {
 		if (phase != NtLmNegotiate) {
 			cERROR(1, "Unexpected more processing error");