| Message ID | 20190523041243.12340-1-jencce.kernel@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free | expand |
On Thu, May 23, 2019 at 2:14 PM Murphy Zhou <jencce.kernel@gmail.com> wrote: > > The 2nd buffer could be NULL even if iov_len is not zero. This can > trigger a panic when handling symlinks. It's easy to reproduce with > LTP fs_racer scripts[1] which are randomly craete/delete/link files > and dirs. Fix this panic by checking if the 2nd buffer is padding > before kfree, like what we do in SMB2_open_free. Looks good. Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com> > > [1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer > > Fixes: 2c87d6a ("cifs: Allocate memory for all iovs in smb2_ioctl") > Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com> > --- > fs/cifs/smb2pdu.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c > index 710ceb8..c36f940 100644 > --- a/fs/cifs/smb2pdu.c > +++ b/fs/cifs/smb2pdu.c > @@ -2619,10 +2619,12 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, > void > SMB2_ioctl_free(struct smb_rqst *rqst) > { > + int i; > if (rqst && rqst->rq_iov) { > cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ > - if (rqst->rq_iov[1].iov_len) > - kfree(rqst->rq_iov[1].iov_base); > + for (i = 1; i < rqst->rq_nvec; i++) > + if (rqst->rq_iov[i].iov_base != smb2_padding) > + kfree(rqst->rq_iov[i].iov_base); > } > } > > -- > 1.8.3.1 >
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 710ceb8..c36f940 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2619,10 +2619,12 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, void SMB2_ioctl_free(struct smb_rqst *rqst) { + int i; if (rqst && rqst->rq_iov) { cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ - if (rqst->rq_iov[1].iov_len) - kfree(rqst->rq_iov[1].iov_base); + for (i = 1; i < rqst->rq_nvec; i++) + if (rqst->rq_iov[i].iov_base != smb2_padding) + kfree(rqst->rq_iov[i].iov_base); } }
The 2nd buffer could be NULL even if iov_len is not zero. This can trigger a panic when handling symlinks. It's easy to reproduce with LTP fs_racer scripts[1] which are randomly craete/delete/link files and dirs. Fix this panic by checking if the 2nd buffer is padding before kfree, like what we do in SMB2_open_free. [1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer Fixes: 2c87d6a ("cifs: Allocate memory for all iovs in smb2_ioctl") Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com> --- fs/cifs/smb2pdu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)