github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

three client fixes

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmp1B8QACgkQiiy9cAdy
 T1Hxxgv/VvHfzlg/s711WorN6MskMtOLx/hK8OS0bPZLqz+qyCIAJbCIWS9CrUCs
 BETMwoElVOoN1MAA9ACEQMrs3PF/+rQVN7OuA5Axh6pBxYqkJLoou521S6HVPKbv
 cUmn2cwvEMiApSJgBKPGyPaQtQcuLSxEZ8tJQtu6mat+tda63UwI/KhqS7GsZDdq
 SSP4aGl58HGtpK/+mHa9yUC8PogiFptmAvQhYDGhs4QFjx1c/eMAwe2x9bHYvzjq
 2zyPd+C3g1anL91YOKcjmgBlorMhG+7wwEC1THoSw7uxqNQUa4ZevpwxfHYFEYNx
 xPVZPfgsrelR14eS2hvhB2d0uu4mIKIx9y2QSanK3KSoGg2TLSAC9UI3fLTl4EqK
 MlQoU6OqA6QiV7UZQfAuRfz3eXVThvvHOXl8r/elLkp/LccBi6xP378+RqsQXtIm
 x98242gMXTlmQ21JqR7ktWahAS0X78wqDz78Fk6Mk3xnGhAsHvpQGUYKnxw6uhZj
 HzayQgz4
 =MCxD
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Fix potential use after free in cifs_try_adding_channels

 - Fix SMB1 large directory enumeration

 - Minor debug improvement (show compress mount option)

* tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
  smb: client: Fix use-after-free in cifs_try_adding_channels()
  smb/client: show compress mount option
This commit is contained in:
Linus Torvalds 2026-08-06 15:38:00 -07:00
commit c0a27675ea
3 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/smb/client/cifsfs.c
View File

@ -692,6 +692,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
seq_puts(s, ",seal");
else if (tcon->ses->server->ignore_signature)
seq_puts(s, ",signloosely");
if (cifs_sb->ctx->compress)
seq_puts(s, ",compress");
if (tcon->nocase)
seq_puts(s, ",nocase");
if (tcon->nodelete)

2
fs/smb/client/sess.c
View File

@ -233,9 +233,9 @@ int cifs_try_adding_channels(struct cifs_ses *ses)
cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
&iface->sockaddr,
rc);
kref_put(&iface->refcount, release_iface);
/* failure to add chan should increase weight */
iface->weight_fulfilled++;
kref_put(&iface->refcount, release_iface);
continue;
}

28
fs/smb/client/smb1transport.c
View File

@ -260,9 +260,23 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
goto out;
if (out_buf) {
*pbytes_returned = resp_iov.iov_len;
if (resp_iov.iov_len)
memcpy(out_buf, resp_iov.iov_base, resp_iov.iov_len);
/* Use smbCalcSize() for both single- and multi-part T2 responses,
* both here and in coalesce_t2().
*/
unsigned int copy_len;
if (WARN_ON_ONCE(!resp_iov.iov_base)) {
rc = -EIO;
goto out;
}
copy_len = smbCalcSize(resp_iov.iov_base);
if (copy_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
cifs_dbg(VFS, "response size %u exceeds buffer\n",
copy_len);
rc = -ENOBUFS;
goto out;
}
*pbytes_returned = copy_len;
memcpy(out_buf, resp_iov.iov_base, copy_len);
}
out:
@ -386,11 +400,13 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr, unsigned int *pdu_len)
}
put_bcc(byte_count, target_hdr);
byte_count = *pdu_len;
byte_count += total_in_src;
/* use smbCalcSize() rather than *pdu_len: the demux loop resets
* *pdu_len to each secondary's pdu_length, making it unreliable.
*/
byte_count = smbCalcSize(target_hdr);
/* don't allow buffer to overflow */
if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
cifs_dbg(FYI, "coalesced BCC exceeds buffer size (%u)\n",
cifs_dbg(FYI, "coalesced size exceeds buffer size (%u)\n",
byte_count);
return -ENOBUFS;
}