From: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
To: linux-cifs <linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>
Cc: Steve French <smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Subject: [PATCH] cifs: fix remaining rsp_iov issues
Date: Wed, 11 Oct 2017 16:41:40 +1100 [thread overview]
Message-ID: <20171011054140.26535-2-lsahlber@redhat.com> (raw)
In-Reply-To: <20171011054140.26535-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
This patch fixes the remaining issues with rsp_iov where
we might dereference uninitialized pointers or pass them
to free_rsp_buf().
There is also one memory leak that is fixed.
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 43 +++++++++++++++++++++++++------------------
1 file changed, 25 insertions(+), 18 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 6ff4c275ca9a..fd2b2b8e86b0 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -470,7 +470,7 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
struct smb2_negotiate_req *req;
struct smb2_negotiate_rsp *rsp;
struct kvec iov[1];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
struct TCP_Server_Info *server = ses->server;
@@ -1884,7 +1884,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
struct smb2_sync_hdr *shdr;
struct cifs_ses *ses;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buftype;
int n_iov;
int rc = 0;
@@ -1981,6 +1981,8 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
rc = SendReceive2(xid, ses, iov, n_iov, &resp_buftype, flags, &rsp_iov);
cifs_small_buf_release(req);
rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
+ if (rsp == NULL)
+ goto ioctl_exit;
if ((rc != 0) && (rc != -EINVAL)) {
cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
@@ -2064,7 +2066,7 @@ SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
struct smb2_close_rsp *rsp;
struct cifs_ses *ses = tcon->ses;
struct kvec iov[1];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buftype;
int rc = 0;
int flags = 0;
@@ -2168,9 +2170,9 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
u32 *dlen)
{
struct smb2_query_info_req *req;
- struct smb2_query_info_rsp *rsp = NULL;
+ struct smb2_query_info_rsp *rsp;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
struct cifs_ses *ses = tcon->ses;
@@ -2404,7 +2406,7 @@ SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
struct smb2_flush_req *req;
struct cifs_ses *ses = tcon->ses;
struct kvec iov[1];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buftype;
int rc = 0;
int flags = 0;
@@ -2639,10 +2641,10 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
{
int resp_buftype, rc = -EACCES;
struct smb2_read_plain_req *req = NULL;
- struct smb2_read_rsp *rsp = NULL;
+ struct smb2_read_rsp *rsp;
struct smb2_sync_hdr *shdr;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
unsigned int total_len;
__be32 req_len;
struct smb_rqst rqst = { .rq_iov = iov,
@@ -2669,6 +2671,10 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
cifs_small_buf_release(req);
rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
+ if (rsp == NULL) {
+ cifs_dbg(VFS, "rsp is NULL in read\n");
+ return -EIO;
+ }
shdr = get_sync_hdr(rsp);
if (shdr->Status == STATUS_END_OF_FILE) {
@@ -2856,9 +2862,9 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
{
int rc = 0;
struct smb2_write_req *req = NULL;
- struct smb2_write_rsp *rsp = NULL;
+ struct smb2_write_rsp *rsp;
int resp_buftype;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int flags = 0;
*nbytes = 0;
@@ -2963,7 +2969,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
struct smb2_query_directory_req *req;
struct smb2_query_directory_rsp *rsp = NULL;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int len;
int resp_buftype = CIFS_NO_BUFFER;
@@ -3093,9 +3099,9 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
void **data, unsigned int *size)
{
struct smb2_set_info_req *req;
- struct smb2_set_info_rsp *rsp = NULL;
+ struct smb2_set_info_rsp *rsp;
struct kvec *iov;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
unsigned int i;
@@ -3376,9 +3382,9 @@ int
SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
{
- struct smb2_query_info_rsp *rsp = NULL;
+ struct smb2_query_info_rsp *rsp;
struct kvec iov;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
struct cifs_ses *ses = tcon->ses;
@@ -3419,9 +3425,9 @@ int
SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
u64 persistent_fid, u64 volatile_fid, int level)
{
- struct smb2_query_info_rsp *rsp = NULL;
+ struct smb2_query_info_rsp *rsp;
struct kvec iov;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype, max_len, min_len;
struct cifs_ses *ses = tcon->ses;
@@ -3492,7 +3498,7 @@ smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
int rc = 0;
struct smb2_lock_req *req = NULL;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buf_type;
unsigned int count;
int flags = CIFS_NO_RESP;
@@ -3525,6 +3531,7 @@ smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
rc = SendReceive2(xid, tcon->ses, iov, 2, &resp_buf_type, flags,
&rsp_iov);
cifs_small_buf_release(req);
+ free_rsp_buf(resp_buf_type, rsp_iov.iov_base);
if (rc) {
cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
--
2.13.3
next prev parent reply other threads:[~2017-10-11 5:41 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-11 5:41 [PATCH 0/1] cifs: fix remaining rsp_iov pointer issues Ronnie Sahlberg
[not found] ` <20171011054140.26535-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-10-11 5:41 ` Ronnie Sahlberg [this message]
[not found] ` <20171011054140.26535-2-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-10-11 15:18 ` [PATCH] cifs: fix remaining rsp_iov issues Steve French
2017-10-11 18:33 ` Pavel Shilovsky
[not found] ` <CAKywueSTNHYLKfyv1eJxvpp0XkTq=TE+v=ifh8AG3M+7CS6ZFQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-10-11 23:33 ` ronnie sahlberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171011054140.26535-2-lsahlber@redhat.com \
--to=lsahlber-h+wxahxf7alqt0dzr+alfa@public.gmane.org \
--cc=linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox