Looks good. Acked-by: Pavel Shilovsky <pshilov@xxxxxxxxxxxxx> Best regards, Pavel Shilovskiy 2017-10-20 5:49 GMT-07:00 David Disseldorp via samba-technical <samba-technical@xxxxxxxxxxxxxxx>: > An undersize validate negotiate info server response causes the client > to use uninitialised memory for struct validate_negotiate_info_rsp > comparisons of Dialect, SecurityMode and/or Capabilities members. > > Link: https://bugzilla.samba.org/show_bug.cgi?id=13092 > Fixes: 7db0a6efdc3e ("SMB3: Work around mount failure when using SMB3 dialect to Macs") > Signed-off-by: David Disseldorp <ddiss@xxxxxxx> > --- > fs/cifs/smb2pdu.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c > index 052ab5dee6b6..c836de2f79b2 100644 > --- a/fs/cifs/smb2pdu.c > +++ b/fs/cifs/smb2pdu.c > @@ -727,7 +727,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) > rsplen); > > /* relax check since Mac returns max bufsize allowed on ioctl */ > - if (rsplen > CIFSMaxBufSize) > + if ((rsplen > CIFSMaxBufSize) > + || (rsplen < sizeof(struct validate_negotiate_info_rsp))) > goto err_rsp_free; > } > > -- > 2.13.6 > > -- To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
