linux-kernel - [PATCH 3.2 078/147] cifs: check MaxPathNameComponentLength != 0 before using it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1510009387.293576520@decadent.org.uk>
Date:   Mon, 06 Nov 2017 23:03:07 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org, "David Disseldorp" <ddiss@...ba.org>,
        "Ronnie Sahlberg" <lsahlber@...hat.com>,
        "Steve French" <smfrench@...il.com>
Subject: [PATCH 3.2 078/147] cifs: check MaxPathNameComponentLength != 0
 before using it

3.2.95-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Ronnie Sahlberg <lsahlber@...hat.com>

commit f74bc7c6679200a4a83156bb89cbf6c229fe8ec0 upstream.

And fix tcon leak in error path.

Signed-off-by: Ronnie Sahlberg <lsahlber@...hat.com>
Signed-off-by: Steve French <smfrench@...il.com>
Reviewed-by: David Disseldorp <ddiss@...ba.org>
[bwh: Backported to 3.2: cifs_tcon pointer is tcon, and there's no leak to fix]
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -521,7 +521,8 @@ cifs_lookup(struct inode *parent_dir_ino
 	oplock = pTcon->ses->server->oplocks ? REQ_OPLOCK : 0;
 
 	/* Don't allow path components longer than the server max. */
-	if (unlikely(direntry->d_name.len >
+	if (unlikely(pTcon->fsAttrInfo.MaxPathNameComponentLength &&
+		     direntry->d_name.len >
 		     le32_to_cpu(pTcon->fsAttrInfo.MaxPathNameComponentLength))) {
 		rc = -ENAMETOOLONG;
 		goto lookup_out;