Re: [PATCH v2] cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Pavel,

On Thu, 26 Jul 2018 15:30:32 -0700
Pavel Shilovsky <piastryyy@xxxxxxxxx> wrote:

> > Suggested-by: Aurélien Aptel <aaptel@xxxxxxxx>
> > Fixes: b8c32dbb0deb ("CIFS: Request SMB2.1 leases")
> > Signed-off-by: Stefano Brivio <sbrivio@xxxxxxxxxx>  
> 
> The commit listed above is not correct. The one that introduced the
> problem is a93864d93977b99bda6c348a09b90a3d7ef8db3a
> (https://git.samba.org/?p=sfrench/cifs-2.6.git;a=commitdiff;h=a93864d93977b99bda6c348a09b90a3d7ef8db3a;hp=2fbb56446fde14a80790de9b182ae6f7c36a039a)
> was merged recently, so, there is no need to push to stable kernels as
> it might be seemed previously looking at the problematic commit.

Maybe I'm missing something, but commit b8c32dbb0deb ("CIFS: Request
SMB2.1 leases") introduces:

	buf->lcontext.LeaseKeyLow = cpu_to_le64(*((u64 *)lease_key));
	buf->lcontext.LeaseKeyHigh = cpu_to_le64(*((u64 *)(lease_key + 8)));

in create_lease_buf(). If we reach that coming from smb2_open_file(),
it's fine, but if we're coming from other callers of SMB2_open() (see e.g.
smb2_query_dir_first() at b8c32dbb0deb) we hit the same issue, don't we?

-- 
Stefano
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux