cifs: fix oops on mount when CONFIG_CIFS_DFS_UPCALL is enabled

PATCH In review Marcin Slusarz 3 participants 3 messages Jun 7, 2008 – Jun 8, 2008

Share & tools

Marcin Slusarz

author

2008-06-07 19:02 UTC #0 lore raw

PATCH 1/1 cifs: fix oops on mount when CONFIG_CIFS_DFS_UPCALL is enabled

simple "mount -t cifs //xxx /mnt" oopsed on strlen of options
http://kerneloops.org/guilty.php?guilty=cifs_get_sb&version=2.6.25-release&start=1671168&end=1703935&class=oops

Signed-off-by Marcin Slusarz <[email protected]>

Cc Steve French <[email protected]>

Cc [email protected]

---
 fs/cifs/cifsfs.c |   21 ++++++++++-----------
 1 files changed, 10 insertions(+), 11 deletions(-)

fs/cifs/cifsfs.c +10 ~~-11~~

index 5df93fd..86b4d5f 100644
@@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
 {
 	struct inode *inode;
 	struct cifs_sb_info *cifs_sb;
-#ifdef CONFIG_CIFS_DFS_UPCALL
-	int len;
-#endif
 	int rc = 0;
 
 	/* BB should we make this contingent on mount parm? */

@@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
 	 * complex operation (mount), and in case of fail
 	 * just exit instead of doing mount and attempting
 	 * undo it if this copy fails?*/
-	len = strlen(data);
-	cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
-	if (cifs_sb->mountdata == NULL) {
-		kfree(sb->s_fs_info);
-		sb->s_fs_info = NULL;
-		return -ENOMEM;
+	if (data) {
+		int len = strlen(data);
+		cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
+		if (cifs_sb->mountdata == NULL) {
+			kfree(sb->s_fs_info);
+			sb->s_fs_info = NULL;
+			return -ENOMEM;
+		}
+		strncpy(cifs_sb->mountdata, data, len + 1);
+		cifs_sb->mountdata[len] = '\0';
 	}
-	strncpy(cifs_sb->mountdata, data, len + 1);
-	cifs_sb->mountdata[len] = '\0';
 #endif
 
 	rc = cifs_mount(sb, cifs_sb, data, devname);

Signature · 1 line

1.5.4.5

A quick look trough cifs_mount and cifs_parse_mount_options functions shows that mount will fail anyway with error EINVAL when 'data' = NULL. May be moving NULL check at the beginning of function will be better in this case.

From 83d523d13556e98283d0fe34394819f83368efb3 Mon Sep 17 00:00:00 2001
From: q <q@q-desktop.(none)>
Date: Sun, 8 Jun 2008 08:15:07 -0400
Subject: [PATCH] [CIFS] Fix OOPs when 'data' is NULL

Signed-off-by [email protected] <q@q-desktop.(none)>

---
 fs/cifs/cifsfs.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

fs/cifs/cifsfs.c +3 -0

index e9f4ec7..aee6b9d 100644
@@ -102,6 +102,9 @@ cifs_read_super(struct super_block *sb, void *data,
 #endif
 	int rc = 0;
 
+	if (!data)
+		return -EINVAL;
+
 	/* BB should we make this contingent on mount parm? */
 	sb->s_flags |= MS_NODIRATIME | MS_NOATIME;
 	sb->s_fs_info = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL);

Signature · 1 line

1.5.4.3

Steve French

2008-06-08 20:17 UTC #2 lore raw

I have not tried this code path recently and mount.cifs should always be filling in the data field (with at least one mount option) but in a case where the mount helper is missing, and the UNC name is of the form //ip_address_of_server/share_name then I would prefer that we treat this case (no mount options specified) as:
1) userid is \0 (null user)
2) null password
3) server id address comes from the beginning of the UNC name (required or we fail)
The rest of the parms are at their defaults:
e.g. sec=ntlm (for smb2 this will be ntlmv2, and perhaps we should change the default for cifs as well)

Quoted 5 lines · Q (Igor Mammedov)

A quick look trough cifs_mount and cifs_parse_mount_options functions shows that mount will fail anyway with error EINVAL when 'data' = NULL. May be moving NULL check at the beginning of function will be better in this case.

Signature · 3 lines

Thanks,

Steve