From patchwork Tue Apr 3 21:00:40 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Gustavo A. R. Silva" X-Patchwork-Id: 894810 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=linux-cifs-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=embeddedor.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40G2CS5S4Kz9s08 for ; Wed, 4 Apr 2018 07:24:04 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753499AbeDCVYD (ORCPT ); Tue, 3 Apr 2018 17:24:03 -0400 Received: from gateway23.websitewelcome.com ([192.185.50.119]:25161 "EHLO gateway23.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752547AbeDCVYD (ORCPT ); Tue, 3 Apr 2018 17:24:03 -0400 X-Greylist: delayed 1402 seconds by postgrey-1.27 at vger.kernel.org; Tue, 03 Apr 2018 17:24:03 EDT Received: from cm10.websitewelcome.com (cm10.websitewelcome.com [100.42.49.4]) by gateway23.websitewelcome.com (Postfix) with ESMTP id ED5DA1E22E for ; Tue, 3 Apr 2018 16:00:40 -0500 (CDT) Received: from gator4166.hostgator.com ([108.167.133.22]) by cmsmtp with SMTP id 3T2mfEn20cGlp3T2mf0dEb; Tue, 03 Apr 2018 16:00:40 -0500 Received: from [189.145.54.187] (port=53634 helo=embeddedor) by gator4166.hostgator.com with esmtpa (Exim 4.89_1) (envelope-from ) id 1f3T2m-000IaQ-Ho; Tue, 03 Apr 2018 16:00:40 -0500 Date: Tue, 3 Apr 2018 16:00:40 -0500 From: "Gustavo A. R. Silva" To: Ronnie Sahlberg , Steve French Cc: linux-cifs@vger.kernel.org, samba-technical@lists.samba.org, linux-kernel@vger.kernel.org, "Gustavo A. R. Silva" Subject: [PATCH v2] cifs: smb2pdu: Fix potential NULL pointer dereference Message-ID: <20180403210039.GA28968@embeddedor.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.145.54.187 X-Source-L: No X-Exim-ID: 1f3T2m-000IaQ-Ho X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedor) [189.145.54.187]:53634 X-Source-Auth: gustavo@embeddedor.com X-Email-Count: 3 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org tcon->ses is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer dereference after tcon->ses has been properly null checked. Addresses-Coverity-ID: 1467426 ("Dereference before null check") Fixes: 93012bf98416 ("cifs: add server->vals->header_preamble_size") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Aurelien Aptel --- Changes in v2: - Update subject. fs/cifs/smb2pdu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index f7741ce..e5ac474 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -3454,7 +3454,7 @@ static int build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, int level, int outbuf_len, u64 persistent_fid, u64 volatile_fid) { - struct TCP_Server_Info *server = tcon->ses->server; + struct TCP_Server_Info *server; int rc; struct smb2_query_info_req *req; unsigned int total_len; @@ -3464,6 +3464,8 @@ build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, int level, if ((tcon->ses == NULL) || (tcon->ses->server == NULL)) return -EIO; + server = tcon->ses->server; + rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, (void **) &req, &total_len); if (rc)