Re: [PATCH] cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Reviewed the patch in more detail - and it looks correct am merging
this and the other fixes for cc:stable today into cifs-2.6.git
for-next

Thanks for spotting this.


On Thu, Jul 5, 2018 at 9:59 AM Stefano Brivio <sbrivio@xxxxxxxxxx> wrote:
>
> On Thu, 05 Jul 2018 16:35:00 +0200
> Aurélien Aptel <aaptel@xxxxxxxx> wrote:
>
> > Stefano Brivio <sbrivio@xxxxxxxxxx> writes:
> > >     /* BB eventually switch this to SMB2 specific small buf size */
> > > -   *request_buf = cifs_small_buf_get();
> > > +   if (smb2_command == SMB2_SET_INFO)
> > > +           *request_buf = cifs_buf_get();
> > > +   else
> > > +           *request_buf = cifs_small_buf_get();
> > >     if (*request_buf == NULL) {
> > >             /* BB should we add a retry in here if not a writepage? */
> > >             return -ENOMEM;
> > > @@ -3720,7 +3723,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
> > >
> > >     rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
> > >                         &rsp_iov);
> > > -   cifs_small_buf_release(req);
> > > +   cifs_buf_release(req);
> > >     rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
> >
> > Small and large bufs use different mempools, shouldn't the release func
> > match the get func?
>
> I think it does: for SMB2_SET_INFO we'll allocate with cifs_buf_get(),
> which does:
>
>         ret_buf = mempool_alloc(cifs_req_poolp, GFP_NOFS);
>
> and release with cifs_buf_release():
>
>         mempool_free(buf_to_free, cifs_req_poolp);
>
> am I missing something?
>
> --
> Stefano
> --
> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html



-- 
Thanks,

Steve




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux