* [PATCH AUTOSEL 3.18 51/61] cifs: check ntwrk_buf_start for NULL before dereferencing it
[not found] <20190128162623.59854-1-sashal@kernel.org>
@ 2019-01-28 16:26 ` Sasha Levin
0 siblings, 0 replies; only message in thread
From: Sasha Levin @ 2019-01-28 16:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ronnie Sahlberg, Steve French, Sasha Levin, linux-cifs
From: Ronnie Sahlberg <lsahlber@redhat.com>
[ Upstream commit 59a63e479ce36a3f24444c3a36efe82b78e4a8e0 ]
RHBZ: 1021460
There is an issue where when multiple threads open/close the same directory
ntwrk_buf_start might end up being NULL, causing the call to smbCalcSize
later to oops with a NULL deref.
The real bug is why this happens and why this can become NULL for an
open cfile, which should not be allowed.
This patch tries to avoid a oops until the time when we fix the underlying
issue.
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/readdir.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 707d8cf95348..116985335cc1 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -645,7 +645,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
/* scan and find it */
int i;
char *cur_ent;
- char *end_of_smb = cfile->srch_inf.ntwrk_buf_start +
+ char *end_of_smb;
+
+ if (cfile->srch_inf.ntwrk_buf_start == NULL) {
+ cifs_dbg(VFS, "ntwrk_buf_start is NULL during readdir\n");
+ return -EIO;
+ }
+
+ end_of_smb = cfile->srch_inf.ntwrk_buf_start +
server->ops->calc_smb_size(
cfile->srch_inf.ntwrk_buf_start);
--
2.19.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2019-01-28 16:26 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20190128162623.59854-1-sashal@kernel.org>
2019-01-28 16:26 ` [PATCH AUTOSEL 3.18 51/61] cifs: check ntwrk_buf_start for NULL before dereferencing it Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).