evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cifs: Fix potential OOB access of lock element array

Browse source 
commit b9a74cde94957d82003fb9f7ab4777938ca851cd upstream.

If maxBuf is small but non-zero, it could result in a zero sized lock
element array which we would then try and access OOB.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ross Lagerwall 2019-01-08 18:30:57 +00:00 • committed by Greg Kroah-Hartman
parent 05ce0d9d56
commit 9c87abaf4d
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
fs/cifs/file.c
View file

@ -1073,10 +1073,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
/* /*
* Accessing maxBuf is racy with cifs_reconnect - need to store value * Accessing maxBuf is racy with cifs_reconnect - need to store value
* and check it for zero before using. * and check it before using.
*/ */
max_buf = tcon->ses->server->maxBuf; max_buf = tcon->ses->server->maxBuf;
if (!max_buf) { if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) {
free_xid(xid); free_xid(xid);
return -EINVAL; return -EINVAL;
} }
@ -1404,10 +1404,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
/* /*
* Accessing maxBuf is racy with cifs_reconnect - need to store value * Accessing maxBuf is racy with cifs_reconnect - need to store value
* and check it for zero before using. * and check it before using.
*/ */
max_buf = tcon->ses->server->maxBuf; max_buf = tcon->ses->server->maxBuf;
if (!max_buf) if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
return -EINVAL; return -EINVAL;
max_num = (max_buf - sizeof(struct smb_hdr)) / max_num = (max_buf - sizeof(struct smb_hdr)) /

4
fs/cifs/smb2file.c
View file

@ -123,10 +123,10 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
/* /*
* Accessing maxBuf is racy with cifs_reconnect - need to store value * Accessing maxBuf is racy with cifs_reconnect - need to store value
* and check it for zero before using. * and check it before using.
*/ */
max_buf = tcon->ses->server->maxBuf; max_buf = tcon->ses->server->maxBuf;
if (!max_buf) if (max_buf < sizeof(struct smb2_lock_element))
return -EINVAL; return -EINVAL;
max_num = max_buf / sizeof(struct smb2_lock_element); max_num = max_buf / sizeof(struct smb2_lock_element);