]>
Commit | Line | Data |
---|---|---|
b32881e5 GKH |
1 | From 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb Mon Sep 17 00:00:00 2001 |
2 | From: Christoph Probst <kernel@probst.it> | |
3 | Date: Tue, 7 May 2019 17:16:40 +0200 | |
4 | Subject: cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() | |
5 | ||
6 | From: Christoph Probst <kernel@probst.it> | |
7 | ||
8 | commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream. | |
9 | ||
10 | Change strcat to strncpy in the "None" case to fix a buffer overflow | |
11 | when cinode->oplock is reset to 0 by another thread accessing the same | |
12 | cinode. It is never valid to append "None" to any other message. | |
13 | ||
14 | Consolidate multiple writes to cinode->oplock to reduce raciness. | |
15 | ||
16 | Signed-off-by: Christoph Probst <kernel@probst.it> | |
17 | Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com> | |
18 | Signed-off-by: Steve French <stfrench@microsoft.com> | |
19 | CC: Stable <stable@vger.kernel.org> | |
20 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
21 | ||
22 | --- | |
23 | fs/cifs/smb2ops.c | 14 ++++++++------ | |
24 | 1 file changed, 8 insertions(+), 6 deletions(-) | |
25 | ||
26 | --- a/fs/cifs/smb2ops.c | |
27 | +++ b/fs/cifs/smb2ops.c | |
28 | @@ -2917,26 +2917,28 @@ smb21_set_oplock_level(struct cifsInodeI | |
29 | unsigned int epoch, bool *purge_cache) | |
30 | { | |
31 | char message[5] = {0}; | |
32 | + unsigned int new_oplock = 0; | |
33 | ||
34 | oplock &= 0xFF; | |
35 | if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE) | |
36 | return; | |
37 | ||
38 | - cinode->oplock = 0; | |
39 | if (oplock & SMB2_LEASE_READ_CACHING_HE) { | |
40 | - cinode->oplock |= CIFS_CACHE_READ_FLG; | |
41 | + new_oplock |= CIFS_CACHE_READ_FLG; | |
42 | strcat(message, "R"); | |
43 | } | |
44 | if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) { | |
45 | - cinode->oplock |= CIFS_CACHE_HANDLE_FLG; | |
46 | + new_oplock |= CIFS_CACHE_HANDLE_FLG; | |
47 | strcat(message, "H"); | |
48 | } | |
49 | if (oplock & SMB2_LEASE_WRITE_CACHING_HE) { | |
50 | - cinode->oplock |= CIFS_CACHE_WRITE_FLG; | |
51 | + new_oplock |= CIFS_CACHE_WRITE_FLG; | |
52 | strcat(message, "W"); | |
53 | } | |
54 | - if (!cinode->oplock) | |
55 | - strcat(message, "None"); | |
56 | + if (!new_oplock) | |
57 | + strncpy(message, "None", sizeof(message)); | |
58 | + | |
59 | + cinode->oplock = new_oplock; | |
60 | cifs_dbg(FYI, "%s Lease granted on inode %p\n", message, | |
61 | &cinode->vfs_inode); | |
62 | } |