leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cifs: fix small mempool leak in SMB2_negotiate()

Browse Source 
In some cases of failure (dialect mismatches) in SMB2_negotiate(), after
the request is sent, the checks would return -EIO when they should be
rather setting rc = -EIO and jumping to neg_exit to free the response
buffer from mempool.

Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Cc: stable@vger.kernel.org
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Enzo Matsumiya 2022-08-30 19:51:51 -03:00 committed by Steve French
parent 3e3761f1ec
commit 27893dfc12
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
fs/cifs/smb2pdu.c
View File

@ -965,16 +965,17 @@ SMB2_negotiate(const unsigned int xid,
} else if (rc != 0) } else if (rc != 0)
goto neg_exit; goto neg_exit;
rc = -EIO;
if (strcmp(server->vals->version_string, if (strcmp(server->vals->version_string,
SMB3ANY_VERSION_STRING) == 0) { SMB3ANY_VERSION_STRING) == 0) {
if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
cifs_server_dbg(VFS, cifs_server_dbg(VFS,
"SMB2 dialect returned but not requested\n"); "SMB2 dialect returned but not requested\n");
return -EIO; goto neg_exit;
} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
cifs_server_dbg(VFS, cifs_server_dbg(VFS,
"SMB2.1 dialect returned but not requested\n"); "SMB2.1 dialect returned but not requested\n");
return -EIO; goto neg_exit;
} else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
/* ops set to 3.0 by default for default so update */ /* ops set to 3.0 by default for default so update */
server->ops = &smb311_operations; server->ops = &smb311_operations;
@ -985,7 +986,7 @@ SMB2_negotiate(const unsigned int xid,
if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
cifs_server_dbg(VFS, cifs_server_dbg(VFS,
"SMB2 dialect returned but not requested\n"); "SMB2 dialect returned but not requested\n");
return -EIO; goto neg_exit;
} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
/* ops set to 3.0 by default for default so update */ /* ops set to 3.0 by default for default so update */
server->ops = &smb21_operations; server->ops = &smb21_operations;
@ -999,7 +1000,7 @@ SMB2_negotiate(const unsigned int xid,
/* if requested single dialect ensure returned dialect matched */ /* if requested single dialect ensure returned dialect matched */
cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n",
le16_to_cpu(rsp->DialectRevision)); le16_to_cpu(rsp->DialectRevision));
return -EIO; goto neg_exit;
} }
cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
@ -1017,9 +1018,10 @@ SMB2_negotiate(const unsigned int xid,
else { else {
cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n",
le16_to_cpu(rsp->DialectRevision)); le16_to_cpu(rsp->DialectRevision));
rc = -EIO;
goto neg_exit; goto neg_exit;
} }
rc = 0;
server->dialect = le16_to_cpu(rsp->DialectRevision); server->dialect = le16_to_cpu(rsp->DialectRevision);
/* /*