CIFS: Fix a possible memory corruption in push locks

piastry · piastry · commit e3d240e9d505 · 2016-12-05T11:08:55.000-08:00
If maxBuf is not 0 but less than a size of SMB2 lock structure
we can end up with a memory corruption.

Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Pavel Shilovsky &lt;pshilov@microsoft.com&gt;
diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
@@ -260,7 +260,7 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile)
 	 * and check it for zero before using.
 	 */
 	max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf;
-	if (!max_buf) {
+	if (max_buf < sizeof(struct smb2_lock_element)) {
 		free_xid(xid);
 		return -EINVAL;
 	}

Original file line number	Diff line number	Diff line change
`@@ -260,7 +260,7 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile)`
`260`	`260`	`* and check it for zero before using.`
`261`	`261`	`*/`
`262`	`262`	`max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf;`
`263`		`- if (!max_buf) {`
	`263`	`+ if (max_buf < sizeof(struct smb2_lock_element)) {`
`264`	`264`	`free_xid(xid);`
`265`	`265`	`return -EINVAL;`
`266`	`266`	`}`