lkml.org 
[lkml]   [2012]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[34-longterm 141/179] cifs: fix NULL pointer dereference in cifs_find_smb_ses
    Date
    From: Jeff Layton <jlayton@redhat.com>

    -------------------
    This is a commit scheduled for the next v2.6.34 longterm release.
    http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
    If you see a problem with using this for longterm, please comment.
    -------------------

    commit fc87a40677bbe0937e2ff0642c7e83c9a4813f3d upstream.

    cifs_find_smb_ses assumes that the vol->password field is a valid
    pointer, but that's only the case if a password was passed in via
    the options string. It's possible that one won't be if there is
    no mount helper on the box.

    Reported-by: diabel <gacek-2004@wp.pl>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    fs/cifs/connect.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    index 4e134a7..0fbc8d2 100644
    --- a/fs/cifs/connect.c
    +++ b/fs/cifs/connect.c
    @@ -1609,7 +1609,8 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
    MAX_USERNAME_SIZE))
    continue;
    if (strlen(vol->username) != 0 &&
    - strncmp(ses->password, vol->password,
    + strncmp(ses->password,
    + vol->password ? vol->password : "",
    MAX_PASSWORD_SIZE))
    continue;
    }
    --
    1.7.9.6


    \
     
     \ /
      Last update: 2012-05-15 06:21    [W:0.025 / U:119.028 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site