From patchwork Tue Oct 25 16:12:27 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [maverick, maverick/ti-omap4, CVE, 2/3] cifs: fix NULL pointer dereference in cifs_find_smb_ses From: Andy Whitcroft X-Patchwork-Id: 121735 Message-Id: <1319559148-30401-7-git-send-email-apw@canonical.com> To: kernel-team@lists.ubuntu.com Cc: Andy Whitcroft Date: Tue, 25 Oct 2011 17:12:27 +0100 From: Jeff Layton cifs_find_smb_ses assumes that the vol->password field is a valid pointer, but that's only the case if a password was passed in via the options string. It's possible that one won't be if there is no mount helper on the box. Reported-by: diabel Signed-off-by: Jeff Layton Signed-off-by: Steve French (cherry picked from commit fc87a40677bbe0937e2ff0642c7e83c9a4813f3d) CVE-2011-1585 BugLink: http://bugs.launchpad.net/bugs/869208 Signed-off-by: Andy Whitcroft --- fs/cifs/connect.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 7a509b6..3cc37e0 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1608,7 +1608,8 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol) MAX_USERNAME_SIZE)) continue; if (strlen(vol->username) != 0 && - strncmp(ses->password, vol->password, + strncmp(ses->password, + vol->password ? vol->password : "", MAX_PASSWORD_SIZE)) continue; }