diff options
| author | Ronnie Sahlberg | 2019-07-16 02:41:46 +0200 |
|---|---|---|
| committer | Steve French | 2019-07-16 04:20:09 +0200 |
| commit | 88a92c913cef09e70b1744a8877d177aa6cb2189 (patch) | |
| tree | 963990acacc7764fd1d094cba922547489d866b1 /fs/cifs/smb2ops.c | |
| parent | cifs: fix crash in cifs_dfs_do_automount (diff) | |
| download | kernel-qcow2-linux-88a92c913cef09e70b1744a8877d177aa6cb2189.tar.gz kernel-qcow2-linux-88a92c913cef09e70b1744a8877d177aa6cb2189.tar.xz kernel-qcow2-linux-88a92c913cef09e70b1744a8877d177aa6cb2189.zip | |
cifs: fix crash in smb2_compound_op()/smb2_set_next_command()
RHBZ: 1722704
In low memory situations the various SMB2_*_init() functions can fail
to allocate a request PDU and thus leave the request iovector as NULL.
If we don't check the return code for failure we end up calling
smb2_set_next_command() with a NULL iovector causing a crash when it tries
to dereference it.
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/cifs/smb2ops.c')
| -rw-r--r-- | fs/cifs/smb2ops.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index e704e04891fb..0cdc4e47ca87 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -2027,6 +2027,10 @@ smb2_set_related(struct smb_rqst *rqst) struct smb2_sync_hdr *shdr; shdr = (struct smb2_sync_hdr *)(rqst->rq_iov[0].iov_base); + if (shdr == NULL) { + cifs_dbg(FYI, "shdr NULL in smb2_set_related\n"); + return; + } shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; } @@ -2041,6 +2045,12 @@ smb2_set_next_command(struct cifs_tcon *tcon, struct smb_rqst *rqst) unsigned long len = smb_rqst_len(server, rqst); int i, num_padding; + shdr = (struct smb2_sync_hdr *)(rqst->rq_iov[0].iov_base); + if (shdr == NULL) { + cifs_dbg(FYI, "shdr NULL in smb2_set_next_command\n"); + return; + } + /* SMB headers in a compound are 8 byte aligned. */ /* No padding needed */ @@ -2080,7 +2090,6 @@ smb2_set_next_command(struct cifs_tcon *tcon, struct smb_rqst *rqst) } finished: - shdr = (struct smb2_sync_hdr *)(rqst->rq_iov[0].iov_base); shdr->NextCommand = cpu_to_le32(len); } |