linux-kernel - [PATCH 28/37] cifs: SMB1 split: Don't return smb_hdr from cifs_{,small_}buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251222223006.1075635-29-dhowells@redhat.com>
Date: Mon, 22 Dec 2025 22:29:53 +0000
From: David Howells <dhowells@...hat.com>
To: Steve French <sfrench@...ba.org>
Cc: David Howells <dhowells@...hat.com>,
	Paulo Alcantara <pc@...guebit.org>,
	Enzo Matsumiya <ematsumiya@...e.de>,
	linux-cifs@...r.kernel.org,
	linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 28/37] cifs: SMB1 split: Don't return smb_hdr from cifs_{,small_}buf_get()

Return void* rather than struct smb_hdr* from from cifs_buf_get() and
cifs_small_buf_get() as SMB2/3 shouldn't be accessing smb_hdr.

Signed-off-by: David Howells <dhowells@...hat.com>
cc: Steve French <sfrench@...ba.org>
cc: Paulo Alcantara <pc@...guebit.org>
cc: Enzo Matsumiya <ematsumiya@...e.de>
cc: linux-cifs@...r.kernel.org
cc: linux-fsdevel@...r.kernel.org
cc: linux-kernel@...r.kernel.org
---
 fs/smb/client/cifsproto.h | 4 ++--
 fs/smb/client/misc.c      | 9 ++++-----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h
index 53d23958b9da..6cf084aeb30e 100644
--- a/fs/smb/client/cifsproto.h
+++ b/fs/smb/client/cifsproto.h
@@ -26,9 +26,9 @@ struct smb3_fs_context;
  *****************************************************************
  */
 
-struct smb_hdr *cifs_buf_get(void);
+void *cifs_buf_get(void);
 void cifs_buf_release(void *buf_to_free);
-struct smb_hdr *cifs_small_buf_get(void);
+void *cifs_small_buf_get(void);
 void cifs_small_buf_release(void *buf_to_free);
 void free_rsp_buf(int resp_buftype, void *rsp);
 int smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c
index dab2d594f024..273c54d39857 100644
--- a/fs/smb/client/misc.c
+++ b/fs/smb/client/misc.c
@@ -178,10 +178,10 @@ tconInfoFree(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace)
 	kfree(tcon);
 }
 
-struct smb_hdr *
+void *
 cifs_buf_get(void)
 {
-	struct smb_hdr *ret_buf = NULL;
+	void *ret_buf = NULL;
 	/*
 	 * SMB2 header is bigger than CIFS one - no problems to clean some
 	 * more bytes for CIFS.
@@ -220,10 +220,10 @@ cifs_buf_release(void *buf_to_free)
 	return;
 }
 
-struct smb_hdr *
+void *
 cifs_small_buf_get(void)
 {
-	struct smb_hdr *ret_buf = NULL;
+	void *ret_buf = NULL;
 
 /* We could use negotiated size instead of max_msgsize -
    but it may be more efficient to always alloc same size
@@ -231,7 +231,6 @@ cifs_small_buf_get(void)
    defaults to this and can not be bigger */
 	ret_buf = mempool_alloc(cifs_sm_req_poolp, GFP_NOFS);
 	/* No need to clear memory here, cleared in header assemble */
-	/*	memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
 	atomic_inc(&small_buf_alloc_count);
 #ifdef CONFIG_CIFS_STATS2
 	atomic_inc(&total_small_buf_alloc_count);