MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-18 23:29:57 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()

Browse Source 
[ Upstream commit 4e8771a366 ]

null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE)
and parse_lease_state() return NULL.

Fix this by check if 'lease_ctx_info' is NULL.

Additionally, remove the redundant parentheses in
parse_durable_handle_context().

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
ChenXiaoSong 2024-08-22 08:20:51 +00:00 committed by Greg Kroah-Hartman
parent b777131d03
commit 07f384c5be
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/smb/server/oplock.c
View File

@ -1510,7 +1510,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease)
* parse_lease_state() - parse lease context containted in file open request * parse_lease_state() - parse lease context containted in file open request
* @open_req: buffer containing smb2 file open(create) request * @open_req: buffer containing smb2 file open(create) request
* *
* Return: oplock state, -ENOENT if create lease context not found * Return: allocated lease context object on success, otherwise NULL
*/ */
struct lease_ctx_info *parse_lease_state(void *open_req) struct lease_ctx_info *parse_lease_state(void *open_req)
{ {

10
fs/smb/server/smb2pdu.c
View File

@ -2771,8 +2771,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
} }
} }
if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||
req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) { req_op_level == SMB2_OPLOCK_LEVEL_BATCH) {
dh_info->CreateGuid = dh_info->CreateGuid =
durable_v2_blob->CreateGuid; durable_v2_blob->CreateGuid;
dh_info->persistent = dh_info->persistent =
@ -2792,8 +2792,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
goto out; goto out;
} }
if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||
req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) { req_op_level == SMB2_OPLOCK_LEVEL_BATCH) {
ksmbd_debug(SMB, "Request for durable open\n"); ksmbd_debug(SMB, "Request for durable open\n");
dh_info->type = dh_idx; dh_info->type = dh_idx;
} }
@ -3415,7 +3415,7 @@ int smb2_open(struct ksmbd_work *work)
goto err_out1; goto err_out1;
} }
} else { } else {
if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) { if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) {
if (S_ISDIR(file_inode(filp)->i_mode)) { if (S_ISDIR(file_inode(filp)->i_mode)) {
lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE; lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE;
lc->is_dir = true; lc->is_dir = true;