Re: [PATCH] cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jul 5, 2018 at 9:35 AM Aurélien Aptel <aaptel@xxxxxxxx> wrote:
>
> Stefano Brivio <sbrivio@xxxxxxxxxx> writes:
> >       /* BB eventually switch this to SMB2 specific small buf size */
> > -     *request_buf = cifs_small_buf_get();
> > +     if (smb2_command == SMB2_SET_INFO)
> > +             *request_buf = cifs_buf_get();
> > +     else
> > +             *request_buf = cifs_small_buf_get();
> >       if (*request_buf == NULL) {
> >               /* BB should we add a retry in here if not a writepage? */
> >               return -ENOMEM;
> > @@ -3720,7 +3723,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
> >
> >       rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
> >                           &rsp_iov);
> > -     cifs_small_buf_release(req);
> > +     cifs_buf_release(req);
> >       rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
>
> Small and large bufs use different mempools, shouldn't the release func
> match the get func?

Yes

Stefano,
Can you respin your patch?  I am hoping this patch addresses a bug I
have been seeing


-- 
Thanks,

Steve




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux