| Message ID | 20191014085923.14967-1-rbergant@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | CIFS: avoid using MID 0xFFFF | expand |
On Mon, Oct 14, 2019 at 7:01 PM Roberto Bergantinos Corpas <rbergant@redhat.com> wrote: > > According to MS-CIFS specification MID 0xFFFF should not be used by the > CIFS client, but we actually do. Besides, this has proven to cause races > leading to oops between SendReceive2/cifs_demultiplex_thread. On SMB1, > MID is a 2 byte value easy to reach in CurrentMid which may conflict with > an oplock break notification request coming from server > > Signed-off-by: Roberto Bergantinos Corpas <rbergant@redhat.com> > --- > fs/cifs/smb1ops.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c > index c4e75afa3258..c8d96230cbd2 100644 > --- a/fs/cifs/smb1ops.c > +++ b/fs/cifs/smb1ops.c > @@ -183,6 +183,9 @@ cifs_get_next_mid(struct TCP_Server_Info *server) > /* we do not want to loop forever */ > last_mid = cur_mid; > cur_mid++; > + /* avoid 0xFFFF MID */ > + if (cur_mid == 0xffff) > + cur_mid++; > > /* > * This nested loop looks more expensive than it is. > -- Reviewed-by: lsahlber@redhat.com> Steve, can we get this pushed to linus soonish? It is a bad issue.
"ronnie sahlberg" <ronniesahlberg@gmail.com> writes:
> Steve, can we get this pushed to linus soonish? It is a bad issue.
Probably a good idea to CC: stable
Cheers,
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c index c4e75afa3258..c8d96230cbd2 100644 --- a/fs/cifs/smb1ops.c +++ b/fs/cifs/smb1ops.c @@ -183,6 +183,9 @@ cifs_get_next_mid(struct TCP_Server_Info *server) /* we do not want to loop forever */ last_mid = cur_mid; cur_mid++; + /* avoid 0xFFFF MID */ + if (cur_mid == 0xffff) + cur_mid++; /* * This nested loop looks more expensive than it is.
According to MS-CIFS specification MID 0xFFFF should not be used by the CIFS client, but we actually do. Besides, this has proven to cause races leading to oops between SendReceive2/cifs_demultiplex_thread. On SMB1, MID is a 2 byte value easy to reach in CurrentMid which may conflict with an oplock break notification request coming from server Signed-off-by: Roberto Bergantinos Corpas <rbergant@redhat.com> --- fs/cifs/smb1ops.c | 3 +++ 1 file changed, 3 insertions(+)