From: Christoph Probst <[email protected]>
commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
Change strcat to strncpy in the "None" case to fix a buffer overflow
when cinode->oplock is reset to 0 by another thread accessing the same
cinode. It is never valid to append "None" to any other message.
Consolidate multiple writes to cinode->oplock to reduce raciness.
Signed-off-by: Christoph Probst <[email protected]>
Reviewed-by: Pavel Shilovsky <[email protected]>
Signed-off-by: Steve French <[email protected]>
CC: Stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/cifs/smb2ops.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1329,26 +1329,28 @@ smb21_set_oplock_level(struct cifsInodeI
unsigned int epoch, bool *purge_cache)
{
char message[5] = {0};
+ unsigned int new_oplock = 0;
oplock &= 0xFF;
if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
return;
- cinode->oplock = 0;
if (oplock & SMB2_LEASE_READ_CACHING_HE) {
- cinode->oplock |= CIFS_CACHE_READ_FLG;
+ new_oplock |= CIFS_CACHE_READ_FLG;
strcat(message, "R");
}
if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
- cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
+ new_oplock |= CIFS_CACHE_HANDLE_FLG;
strcat(message, "H");
}
if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
- cinode->oplock |= CIFS_CACHE_WRITE_FLG;
+ new_oplock |= CIFS_CACHE_WRITE_FLG;
strcat(message, "W");
}
- if (!cinode->oplock)
- strcat(message, "None");
+ if (!new_oplock)
+ strncpy(message, "None", sizeof(message));
+
+ cinode->oplock = new_oplock;
cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
&cinode->vfs_inode);
}
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Sunday, June 9, 2019 9:40 AM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Christoph Probst <[email protected]>; Pavel Shilovskiy <[email protected]>; Steven French <[email protected]>
Subject: [PATCH 4.4 041/241] cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
From: Christoph Probst <[email protected]>
commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
Change strcat to strncpy in the "None" case to fix a buffer overflow when cinode->oplock is reset to 0 by another thread accessing the same cinode. It is never valid to append "None" to any other message.
Consolidate multiple writes to cinode->oplock to reduce raciness.
Signed-off-by: Christoph Probst <[email protected]>
Reviewed-by: Pavel Shilovsky <[email protected]>
Signed-off-by: Steve French <[email protected]>
CC: Stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
--------------------------------
Hi Greg,
This patch has been queued for 4.4.y and has already been merged into 5.1.y (5.1.5). Are you going to apply it to other stable kernels: 4.9, 4.14, 4.19?
Best regards,
Pavel Shilovsky
On Mon, Jun 10, 2019 at 07:13:24PM +0000, Pavel Shilovskiy wrote:
>
> -----Original Message-----
> From: Greg Kroah-Hartman <[email protected]>
> Sent: Sunday, June 9, 2019 9:40 AM
> To: [email protected]
> Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Christoph Probst <[email protected]>; Pavel Shilovskiy <[email protected]>; Steven French <[email protected]>
> Subject: [PATCH 4.4 041/241] cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
>
> From: Christoph Probst <[email protected]>
>
> commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
>
> Change strcat to strncpy in the "None" case to fix a buffer overflow when cinode->oplock is reset to 0 by another thread accessing the same cinode. It is never valid to append "None" to any other message.
>
> Consolidate multiple writes to cinode->oplock to reduce raciness.
>
> Signed-off-by: Christoph Probst <[email protected]>
> Reviewed-by: Pavel Shilovsky <[email protected]>
> Signed-off-by: Steve French <[email protected]>
> CC: Stable <[email protected]>
> Signed-off-by: Greg Kroah-Hartman <[email protected]>
> --------------------------------
>
> Hi Greg,
>
> This patch has been queued for 4.4.y and has already been merged into
> 5.1.y (5.1.5). Are you going to apply it to other stable kernels: 4.9,
> 4.14, 4.19?
It is already in the 4.9.179, 4.14.122, 4.19.46, 5.0.19, and 5.1.5
released kernels. So I don't think I can merge it into them again :)
thanks,
greg k-h
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Tuesday, June 11, 2019 12:20 AM
To: Pavel Shilovskiy <[email protected]>
Cc: [email protected]; [email protected]; Christoph Probst <[email protected]>; Steven French <[email protected]>
Subject: Re: [PATCH 4.4 041/241] cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
On Mon, Jun 10, 2019 at 07:13:24PM +0000, Pavel Shilovskiy wrote:
>
> -----Original Message-----
> From: Greg Kroah-Hartman <[email protected]>
> Sent: Sunday, June 9, 2019 9:40 AM
> To: [email protected]
> Cc: Greg Kroah-Hartman <[email protected]>;
> [email protected]; Christoph Probst <[email protected]>; Pavel
> Shilovskiy <[email protected]>; Steven French
> <[email protected]>
> Subject: [PATCH 4.4 041/241] cifs: fix strcat buffer overflow and
> reduce raciness in smb21_set_oplock_level()
>
> From: Christoph Probst <[email protected]>
>
> commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
>
> Change strcat to strncpy in the "None" case to fix a buffer overflow when cinode->oplock is reset to 0 by another thread accessing the same cinode. It is never valid to append "None" to any other message.
>
> Consolidate multiple writes to cinode->oplock to reduce raciness.
>
> Signed-off-by: Christoph Probst <[email protected]>
> Reviewed-by: Pavel Shilovsky <[email protected]>
> Signed-off-by: Steve French <[email protected]>
> CC: Stable <[email protected]>
> Signed-off-by: Greg Kroah-Hartman <[email protected]>
> --------------------------------
>
> Hi Greg,
>
> This patch has been queued for 4.4.y and has already been merged into
> 5.1.y (5.1.5). Are you going to apply it to other stable kernels: 4.9,
> 4.14, 4.19?
It is already in the 4.9.179, 4.14.122, 4.19.46, 5.0.19, and 5.1.5 released kernels. So I don't think I can merge it into them again :)
thanks,
greg k-h
---------------------------------
You are right, I missed it somehow. Thanks for clarifying!
Best regards,
Pavel Shilovsky