From: "Aurélien Aptel" <aaptel@suse.com>
To: Stefano Brivio <sbrivio@redhat.com>, Steve French <sfrench@samba.org>
Cc: linux-cifs@vger.kernel.org, Ronnie Sahlberg <lsahlber@redhat.com>,
Jianhong Yin <jiyin@redhat.com>,
Pavel Shilovsky <pshilov@microsoft.com>,
Shirish Pargaonkar <shirishpargaonkar@gmail.com>,
stable@vger.kernel.org, Stefano Brivio <sbrivio@redhat.com>
Subject: Re: [PATCH] cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting
Date: Thu, 05 Jul 2018 16:35:00 +0200 [thread overview]
Message-ID: <87d0w17nu3.fsf@suse.com> (raw)
In-Reply-To: <af471807b329692a387ff26e62e1bbca01e1684f.1530783326.git.sbrivio@redhat.com>
Stefano Brivio <sbrivio@redhat.com> writes:
> /* BB eventually switch this to SMB2 specific small buf size */
> - *request_buf = cifs_small_buf_get();
> + if (smb2_command == SMB2_SET_INFO)
> + *request_buf = cifs_buf_get();
> + else
> + *request_buf = cifs_small_buf_get();
> if (*request_buf == NULL) {
> /* BB should we add a retry in here if not a writepage? */
> return -ENOMEM;
> @@ -3720,7 +3723,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
>
> rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
> &rsp_iov);
> - cifs_small_buf_release(req);
> + cifs_buf_release(req);
> rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
Small and large bufs use different mempools, shouldn't the release func
match the get func?
--
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
next prev parent reply other threads:[~2018-07-05 14:35 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-05 9:46 [PATCH] cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting Stefano Brivio
2018-07-05 14:35 ` Aurélien Aptel [this message]
2018-07-05 14:55 ` Steve French
2018-07-05 16:00 ` Stefano Brivio
2018-07-05 17:11 ` Aurélien Aptel
2018-07-05 14:58 ` Stefano Brivio
2018-07-05 16:05 ` Aurélien Aptel
2018-07-05 17:53 ` Steve French
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87d0w17nu3.fsf@suse.com \
--to=aaptel@suse.com \
--cc=jiyin@redhat.com \
--cc=linux-cifs@vger.kernel.org \
--cc=lsahlber@redhat.com \
--cc=pshilov@microsoft.com \
--cc=sbrivio@redhat.com \
--cc=sfrench@samba.org \
--cc=shirishpargaonkar@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).