* [PATCH] fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free
@ 2019-05-23 4:12 Murphy Zhou
2019-05-24 0:44 ` ronnie sahlberg
0 siblings, 1 reply; 2+ messages in thread
From: Murphy Zhou @ 2019-05-23 4:12 UTC (permalink / raw)
To: linux-cifs; +Cc: sfrench, longli, Murphy Zhou
The 2nd buffer could be NULL even if iov_len is not zero. This can
trigger a panic when handling symlinks. It's easy to reproduce with
LTP fs_racer scripts[1] which are randomly craete/delete/link files
and dirs. Fix this panic by checking if the 2nd buffer is padding
before kfree, like what we do in SMB2_open_free.
[1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer
Fixes: 2c87d6a ("cifs: Allocate memory for all iovs in smb2_ioctl")
Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com>
---
fs/cifs/smb2pdu.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 710ceb8..c36f940 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2619,10 +2619,12 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
void
SMB2_ioctl_free(struct smb_rqst *rqst)
{
+ int i;
if (rqst && rqst->rq_iov) {
cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
- if (rqst->rq_iov[1].iov_len)
- kfree(rqst->rq_iov[1].iov_base);
+ for (i = 1; i < rqst->rq_nvec; i++)
+ if (rqst->rq_iov[i].iov_base != smb2_padding)
+ kfree(rqst->rq_iov[i].iov_base);
}
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free
2019-05-23 4:12 [PATCH] fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free Murphy Zhou
@ 2019-05-24 0:44 ` ronnie sahlberg
0 siblings, 0 replies; 2+ messages in thread
From: ronnie sahlberg @ 2019-05-24 0:44 UTC (permalink / raw)
To: Murphy Zhou; +Cc: linux-cifs, Steve French, Long Li
On Thu, May 23, 2019 at 2:14 PM Murphy Zhou <jencce.kernel@gmail.com> wrote:
>
> The 2nd buffer could be NULL even if iov_len is not zero. This can
> trigger a panic when handling symlinks. It's easy to reproduce with
> LTP fs_racer scripts[1] which are randomly craete/delete/link files
> and dirs. Fix this panic by checking if the 2nd buffer is padding
> before kfree, like what we do in SMB2_open_free.
Looks good.
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
>
> [1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer
>
> Fixes: 2c87d6a ("cifs: Allocate memory for all iovs in smb2_ioctl")
> Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com>
> ---
> fs/cifs/smb2pdu.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
> index 710ceb8..c36f940 100644
> --- a/fs/cifs/smb2pdu.c
> +++ b/fs/cifs/smb2pdu.c
> @@ -2619,10 +2619,12 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
> void
> SMB2_ioctl_free(struct smb_rqst *rqst)
> {
> + int i;
> if (rqst && rqst->rq_iov) {
> cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
> - if (rqst->rq_iov[1].iov_len)
> - kfree(rqst->rq_iov[1].iov_base);
> + for (i = 1; i < rqst->rq_nvec; i++)
> + if (rqst->rq_iov[i].iov_base != smb2_padding)
> + kfree(rqst->rq_iov[i].iov_base);
> }
> }
>
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-05-24 0:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-23 4:12 [PATCH] fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free Murphy Zhou
2019-05-24 0:44 ` ronnie sahlberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).