CIFS: Implement follow_link for SMB2
Subsystems (2)
Hello Pavel Shilovsky,
The patch b42bf88828cd: "CIFS: Implement follow_link for SMB2" from Aug 14, 2013, leads to the following static checker warning:
fs/cifs/smb2pdu.c:1408 SMB2_open() warn: potentially allocating too little. 77 vs 4
fs/cifs/smb2pdu.c
1402 rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
1403 rsp = (struct smb2_create_rsp *)iov[0].iov_base;
1404
1405 if (rc != 0) {
1406 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
1407 if (err_buf)
1408 *err_buf = kmemdup(rsp, get_rfc1002_length(rsp) + 4,
I'm not an expert, but these look like it might be controlled from user space. How do we know that get_rfc1002_length() returns something large enough?
1409 GFP_KERNEL);
1410 goto creat_exit;
1411 }
1412
regards,
dan carpenter
2016-07-12 16:55 GMT+03:00 Dan Carpenter <[email protected]>:
Quoted 17 lines
Hello Pavel Shilovsky,
The patch
b42bf88828cd: "CIFS: Implementfollow_linkfor SMB2" from Aug 14, 2013, leads to the following static checker warning:
fs/cifs/smb2pdu.c:1408SMB2_open()
warn: potentially allocating too little. 77 vs 4
fs/cifs/smb2pdu.c
1402 rc =SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
1403 rsp = (structsmb2_create_rsp*)iov[0].iov_base;
1404
1405 if (rc != 0) {
1406cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
1407 if (err_buf)
1408*err_buf= kmemdup(rsp,get_rfc1002_length(rsp)+ 4,
Quoted 3 lines
I'm not an expert, but these look like it might be controlled from user space. How do we know that
get_rfc1002_length()returns something large enough?
Good catch. err_buf is used by smb2_query_symlink() without any checks for a buffer size. Thanks!
Signature · 2 lines
Best regards, Pavel Shilovsky
A message that is not in the archive (sent off-list or not yet received): CAKywueR7pGqL-HqqJH60XxPJ8fr1Mf3H7BZsSp2ePfXkdvH5sQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org
2016-07-19 22:27 GMT+03:00 Pavel Shilovsky <[email protected]>:
Quoted 22 lines
2016-07-12 16:55 GMT+03:00 Dan Carpenter <[email protected]>:
Quoted 17 lines
Hello Pavel Shilovsky,
The patch
b42bf88828cd: "CIFS: Implementfollow_linkfor SMB2" from Aug 14, 2013, leads to the following static checker warning:
fs/cifs/smb2pdu.c:1408SMB2_open()
warn: potentially allocating too little. 77 vs 4
fs/cifs/smb2pdu.c
1402 rc =SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
1403 rsp = (structsmb2_create_rsp*)iov[0].iov_base;
1404
1405 if (rc != 0) {
1406cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
1407 if (err_buf)
1408*err_buf= kmemdup(rsp,get_rfc1002_length(rsp)+ 4,Quoted 3 lines
I'm not an expert, but these look like it might be controlled from user space. How do we know that
get_rfc1002_length()returns something large enough?
Quoted 6 lines
Good catch.
err_bufis used bysmb2_query_symlink()without any checks for a buffer size. Thanks!--
Best regards,
Pavel Shilovsky
I have posted a patch "CIFS: Fix a possible invalid memory access in smb2_query_symlink()" that addressed the problem. It seems like we good in SMB2_open() but an invalid memory access can happen in smb2_query_symlink().
Signature · 2 lines
Best regards, Pavel Shilovsky