cifs: CIFS_ENUMERATE_SNAPSHOTS fixes

A couple of one line fixes for the new CIFS_ENUMERATE_SNAPSHOTS functionality.

 fs/cifs/ioctl.c   | 2 ++
 fs/cifs/smb2ops.c | 1 +
 2 files changed, 3 insertions(+)

As with 618763958b22, an open directory may have a NULL private_data pointer prior to readdir. CIFS_ENUMERATE_SNAPSHOTS must check for this before dereference.

---
 fs/cifs/ioctl.c | 2 ++
 1 file changed, 2 insertions(+)

index 7f4bba574930..4d598a71cf84 100644
@@ -213,6 +213,8 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
 			rc = smb_mnt_get_fsinfo(xid, tcon, (void __user *)arg);
 			break;
 		case CIFS_ENUMERATE_SNAPSHOTS:
+			if (pSMBFile == NULL)
+				break;
 			if (arg == 0) {
 				rc = -EINVAL;
 				goto cifs_ioc_exit;

2.12.0

The server may respond with success, and an output buffer less than sizeof(struct smb_snapshot_array) in length. Do not leak the output buffer in this case.

---
 fs/cifs/smb2ops.c | 1 +
 1 file changed, 1 insertion(+)

index 152e37f2ad92..c58691834eb2 100644
@@ -942,6 +942,7 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon,
 		}
 		if (snapshot_in.snapshot_array_size < sizeof(struct smb_snapshot_array)) {
 			rc = -ERANGE;
+			kfree(retbuf);
 			return rc;
 		}
 

2.12.0

merged into cifs-2.6.git for-next

thx!

Thanks,

Steve

FWIW, below is the xfstests based reproducer that I used to trip the CIFS_ENUMERATE_SNAPSHOTS and CIFS_IOC_GET_MNT_INFO bugs. It can be run against file and dir paths on a cifs.ko mount.

As discussed with Steve, it'd probably make sense to add some sort of xfs_io like helper to cifs-utils, to avoid polluting xfstests with these things (cloner could also go).

Cheers, David

From: David Disseldorp <[email protected]>
Date: Fri, 5 May 2017 13:22:39 +0200
Subject: [PATCH] src/shot: cifs snapshot ioctl helper

---
 src/Makefile |   2 +-
 src/shot.c   | 188 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 189 insertions(+), 1 deletion(-)
 create mode 100644 src/shot.c

index f1338ca9..6378e076 100644
@@ -22,7 +22,7 @@ LINUX_TARGETS = xfsctl bstat t_mtab getdevicesize preallo_rw_pattern_reader \
 	seek_copy_test t_readdir_1 t_readdir_2 fsync-tester nsexec cloner \
 	renameat2 t_getcwd e4compact test-nextquota punch-alternating \
 	attr-list-by-handle-cursor-test listxattr dio-interleaved t_dir_type \
-	dio-invalidate-cache stat_test
+	dio-invalidate-cache stat_test shot
 
 SUBDIRS =
 

2.12.0