cifs: Check for existing directory when opening file with O_CREAT (8d9535b6) · Commits · 戴 / test

When opening a file with O_CREAT flag, check to see if the file opened is an existing directory. This prevents the directory from being opened which subsequently causes a crash when the close function for directories cifs_closedir() is called which frees up the file->private_data memory while the file is still listed on the open file list for the tcon. Signed-off-by:

Sachin Prabhu <sprabhu@redhat.com> Signed-off-by:

Steve French <smfrench@gmail.com> CC: Stable <stable@vger.kernel.org> Reported-by:

Xiaoli Feng <xifeng@redhat.com>

fs/cifs/dir.c

+21 −3

Original line number	Diff line number	Diff line
		@@ -229,6 +229,13 @@ cifs_do_create(struct inode inode, struct dentry direntry, unsigned int xid,
		goto cifs_create_get_file_info;
		}

		if (S_ISDIR(newinode->i_mode)) {
		CIFSSMBClose(xid, tcon, fid->netfid);
		iput(newinode);
		rc = -EISDIR;
		goto out;
		}

		if (!S_ISREG(newinode->i_mode)) {
		/*
		* The server may allow us to open things like
		@@ -399,10 +406,14 @@ cifs_create_set_dentry:
		if (rc != 0) {
		cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n",
		rc);
		if (server->ops->close)
		server->ops->close(xid, tcon, fid);
		goto out;
		goto out_err;
		}

		if (S_ISDIR(newinode->i_mode)) {
		rc = -EISDIR;
		goto out_err;
		}

		d_drop(direntry);
		d_add(direntry, newinode);

		@@ -410,6 +421,13 @@ out:
		kfree(buf);
		kfree(full_path);
		return rc;

		out_err:
		if (server->ops->close)
		server->ops->close(xid, tcon, fid);
		if (newinode)
		iput(newinode);
		goto out;
		}

		int

Admin message