cifs: potential memory leaks when parsing mnt opts

Althouhg mkfs.cifs in userspace performs a bit of sanitization (e.g., forcing one user option), current implementation is not robust. Other options such as iocharset and domainanme are similary vulnerable.

Quoted 5 lines · Taesoo Kim

Althouhg mkfs.cifs in userspace performs a bit of sanitization (e.g., forcing one user option), current implementation is not robust. Other options such as iocharset and domainanme are similary vulnerable.

I assume you mean mount.cifs? :-) Anyways, good catch.

Signature · 2 lines

Peace and Blessings,
-Scott.

Quoted 9 lines · Scott Lovenberg

Quoted 5 lines · Taesoo Kim

Althouhg mkfs.cifs in userspace performs a bit of sanitization (e.g., forcing one user option), current implementation is not robust. Other options such as iocharset and domainanme are similary vulnerable.

I assume you mean mount.cifs? :-) Anyways, good catch.

Right. FYI, I've tried mangling password field (e.g., pass=a,user=A &c); Skimming through the code (just a few minutes), there are a few potential places that don't sanitize its string, unlike passwd. But don't have much time to play with for now :)

Thanks,
Taesoo

Quoted 3 lines

--
Peace and Blessings,
-Scott.

For example, when mount opt is redundently specified (e.g., "user=A,user=B,user=C"), kernel kept allocating new key/val with kstrdup() and overwrite previous ptr (to be freed).

Althouhg mkfs.cifs in userspace performs a bit of sanitization (e.g., forcing one user option), current implementation is not robust. Other options such as iocharset and domainanme are similary vulnerable.

Signed-off-by Taesoo Kim <[email protected]>

---
 fs/cifs/connect.c | 4 ++++
 1 file changed, 4 insertions(+)

fs/cifs/connect.c +4 -1

index d3aa999..4cb8450 100644
@@ -1599,6 +1599,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                pr_warn("CIFS: username too long\n");
                                goto cifs_parse_mount_err;
                        }
+
+                       kfree(vol->username);
                        vol->username = kstrdup(string, GFP_KERNEL);
                        if (!vol->username)
                                goto cifs_parse_mount_err;

@@ -1700,6 +1702,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                goto cifs_parse_mount_err;
                        }
 
+                       kfree(vol->domainname);
                        vol->domainname = kstrdup(string, GFP_KERNEL);
                        if (!vol->domainname) {
                                pr_warn("CIFS: no memory for domainname\n");

@@ -1731,6 +1734,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                        }
 
                         if (strncasecmp(string, "default", 7) != 0) {
+                               kfree(vol->iocharset);
                                vol->iocharset = kstrdup(string,
                                                         GFP_KERNEL);
                                if (!vol->iocharset) {
--

2.3.3