Patch "cifs: Check for existing directory when opening file with O_CREAT" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

cifs: Check for existing directory when opening file with O_CREAT

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
cifs-check-for-existing-directory-when-opening-file-with-o_creat.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Sachin Prabhu <[email protected]>
Date: Thu, 7 Jul 2016 21:28:27 +0100
Subject: cifs: Check for existing directory when opening file with O_CREAT

From: Sachin Prabhu <[email protected]>

commit 8d9535b6efd86e6c07da59f97e68f44efb7fe080 upstream.

When opening a file with O_CREAT flag, check to see if the file opened is an existing directory.

This prevents the directory from being opened which subsequently causes a crash when the close function for directories cifs_closedir() is called which frees up the file->private_data memory while the file is still listed on the open file list for the tcon.

---
 fs/cifs/dir.c |   24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

@@ -245,6 +245,13 @@ cifs_do_create(struct inode *inode, stru
 				goto cifs_create_get_file_info;
 			}
 
+			if (S_ISDIR(newinode->i_mode)) {
+				CIFSSMBClose(xid, tcon, fid->netfid);
+				iput(newinode);
+				rc = -EISDIR;
+				goto out;
+			}
+
 			if (!S_ISREG(newinode->i_mode)) {
 				/*
 				 * The server may allow us to open things like

@@ -415,10 +422,14 @@ cifs_create_set_dentry:
 	if (rc != 0) {
 		cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n",
 			 rc);
-		if (server->ops->close)
-			server->ops->close(xid, tcon, fid);
-		goto out;
+		goto out_err;
 	}
+
+	if (S_ISDIR(newinode->i_mode)) {
+		rc = -EISDIR;
+		goto out_err;
+	}
+
 	d_drop(direntry);
 	d_add(direntry, newinode);
 

@@ -426,6 +437,13 @@ out:
 	kfree(buf);
 	kfree(full_path);
 	return rc;
+
+out_err:
+	if (server->ops->close)
+		server->ops->close(xid, tcon, fid);
+	if (newinode)
+		iput(newinode);
+	goto out;
 }
 
 int

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/cifs-check-for-existing-directory-when-opening-file-with-o_creat.patch queue-4.7/cifs-unbreak-tcp-session-reuse.patch queue-4.7/cifs-fix-crash-due-to-race-in-hmac-md5-handling.patch