queue-4.19/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch

   1 From 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb Mon Sep 17 00:00:00 2001
   2 From: Christoph Probst <kernel@probst.it>
   3 Date: Tue, 7 May 2019 17:16:40 +0200
   4 Subject: cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
   5
   6 From: Christoph Probst <kernel@probst.it>
   7
   8 commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
   9
  10 Change strcat to strncpy in the "None" case to fix a buffer overflow
  11 when cinode->oplock is reset to 0 by another thread accessing the same
  12 cinode. It is never valid to append "None" to any other message.
  13
  14 Consolidate multiple writes to cinode->oplock to reduce raciness.
  15
  16 Signed-off-by: Christoph Probst <kernel@probst.it>
  17 Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
  18 Signed-off-by: Steve French <stfrench@microsoft.com>
  19 CC: Stable <stable@vger.kernel.org>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21
  22 ---
  23  fs/cifs/smb2ops.c |   14 ++++++++------
  24  1 file changed, 8 insertions(+), 6 deletions(-)
  25
  26 --- a/fs/cifs/smb2ops.c
  27 +++ b/fs/cifs/smb2ops.c
  28 @@ -2348,26 +2348,28 @@ smb21_set_oplock_level(struct cifsInodeI
  29                        unsigned int epoch, bool *purge_cache)
  30  {
  31         char message[5] = {0};
  32 +       unsigned int new_oplock = 0;
  33
  34         oplock &= 0xFF;
  35         if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
  36                 return;
  37
  38 -       cinode->oplock = 0;
  39         if (oplock & SMB2_LEASE_READ_CACHING_HE) {
  40 -               cinode->oplock |= CIFS_CACHE_READ_FLG;
  41 +               new_oplock |= CIFS_CACHE_READ_FLG;
  42                 strcat(message, "R");
  43         }
  44         if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
  45 -               cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
  46 +               new_oplock |= CIFS_CACHE_HANDLE_FLG;
  47                 strcat(message, "H");
  48         }
  49         if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
  50 -               cinode->oplock |= CIFS_CACHE_WRITE_FLG;
  51 +               new_oplock |= CIFS_CACHE_WRITE_FLG;
  52                 strcat(message, "W");
  53         }
  54 -       if (!cinode->oplock)
  55 -               strcat(message, "None");
  56 +       if (!new_oplock)
  57 +               strncpy(message, "None", sizeof(message));
  58 +
  59 +       cinode->oplock = new_oplock;
  60         cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
  61                  &cinode->vfs_inode);
  62  }