lkml.org 
[lkml]   [2017]   [Jan]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.8 73/85] CIFS: Fix a possible memory corruption in push locks
    Date
    4.8-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Pavel Shilovsky <pshilov@microsoft.com>

    commit e3d240e9d505fc67f8f8735836df97a794bbd946 upstream.

    If maxBuf is not 0 but less than a size of SMB2 lock structure
    we can end up with a memory corruption.

    Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/cifs/smb2file.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/cifs/smb2file.c
    +++ b/fs/cifs/smb2file.c
    @@ -260,7 +260,7 @@ smb2_push_mandatory_locks(struct cifsFil
    * and check it for zero before using.
    */
    max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf;
    - if (!max_buf) {
    + if (max_buf < sizeof(struct smb2_lock_element)) {
    free_xid(xid);
    return -EINVAL;
    }

    \
     
     \ /
      Last update: 2017-01-04 22:01    [W:4.361 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site