Commit b010a0f7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 

Pull CIFS fixes from Steve French:
 "A set of small cifs fixes fixing a memory leak, kernel oops, and
  infinite loop (and some spotted by Coverity)"

* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
  Fix warning
  Fix another dereference before null check warning
  CIFS: session servername can't be null
  Fix warning on impossible comparison
  Fix coverity warning
  Fix dereference before null check warning
  Don't ignore errors on encrypting password in SMBTcon
  Fix warning on uninitialized buftype
  cifs: potential memory leaks when parsing mnt opts
  cifs: fix use-after-free bug in find_writable_file
  cifs: smb2_clone_range() - exit on unhandled error
parents 8f778bbc 4c5930e8

fs/cifs/cifsencrypt.c

+5 −1
Original line number Diff line number Diff line 
/*

 *   fs/cifs/cifsencrypt.c

 *

 *   Encryption and hashing operations relating to NTLM, NTLMv2.  See MS-NLMP

 *   for more detailed information

 *

 *   Copyright (C) International Business Machines  Corp., 2005,2013

 *   Author(s): Steve French (sfrench@us.ibm.com)

 *
@@ -515,7 +518,8 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash, 
				 __func__);

			return rc;

		}

	} else if (ses->serverName) {

	} else {

		/* We use ses->serverName if no domain name available */

		len = strlen(ses->serverName);



		server = kmalloc(2 + (len * 2), GFP_KERNEL);

fs/cifs/connect.c

+11 −2
Original line number Diff line number Diff line
@@ -1599,6 +1599,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, 
				pr_warn("CIFS: username too long\n");

				goto cifs_parse_mount_err;

			}



			kfree(vol->username);

			vol->username = kstrdup(string, GFP_KERNEL);

			if (!vol->username)

				goto cifs_parse_mount_err;
@@ -1700,6 +1702,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, 
				goto cifs_parse_mount_err;

			}



			kfree(vol->domainname);

			vol->domainname = kstrdup(string, GFP_KERNEL);

			if (!vol->domainname) {

				pr_warn("CIFS: no memory for domainname\n");
@@ -1731,6 +1734,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, 
			}



			 if (strncasecmp(string, "default", 7) != 0) {

				kfree(vol->iocharset);

				vol->iocharset = kstrdup(string,

							 GFP_KERNEL);

				if (!vol->iocharset) {
@@ -2913,8 +2917,7 @@ ip_rfc1001_connect(struct TCP_Server_Info *server) 
		 * calling name ends in null (byte 16) from old smb

		 * convention.

		 */

		if (server->workstation_RFC1001_name &&

		    server->workstation_RFC1001_name[0] != 0)

		if (server->workstation_RFC1001_name[0] != 0)

			rfc1002mangle(ses_init_buf->trailer.

				      session_req.calling_name,

				      server->workstation_RFC1001_name,
@@ -3692,6 +3695,12 @@ CIFSTCon(const unsigned int xid, struct cifs_ses *ses, 
#endif /* CIFS_WEAK_PW_HASH */

		rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,

					bcc_ptr, nls_codepage);

		if (rc) {

			cifs_dbg(FYI, "%s Can't generate NTLM rsp. Error: %d\n",

				 __func__, rc);

			cifs_buf_release(smb_buffer);

			return rc;

		}



		bcc_ptr += CIFS_AUTH_RESP_SIZE;

		if (ses->capabilities & CAP_UNICODE) {

fs/cifs/file.c

+1 −0
Original line number Diff line number Diff line
@@ -1823,6 +1823,7 @@ refind_writable: 
			cifsFileInfo_put(inv_file);

			spin_lock(&cifs_file_list_lock);

			++refind;

			inv_file = NULL;

			goto refind_writable;

		}

	}

fs/cifs/inode.c

+2 −0
Original line number Diff line number Diff line
@@ -771,6 +771,8 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, 
				cifs_buf_release(srchinf->ntwrk_buf_start);

			}

			kfree(srchinf);

			if (rc)

				goto cgii_exit;

	} else

		goto cgii_exit;

fs/cifs/smb2misc.c

+1 −1
Original line number Diff line number Diff line
@@ -322,7 +322,7 @@ smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *hdr) 


	/* return pointer to beginning of data area, ie offset from SMB start */

	if ((*off != 0) && (*len != 0))

		return hdr->ProtocolId + *off;

		return (char *)(&hdr->ProtocolId[0]) + *off;

	else

		return NULL;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE