summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorRonnie Sahlberg <lsahlber@redhat.com>2017-09-08 03:37:35 +0300
committerSteve French <smfrench@gmail.com>2017-09-13 02:11:44 +0300
commitbf2afee14e07de16d3cafc67edbfc2a3cc65e4bc (patch)
treeaba3efa9b9ef3af8c4d233c6acddc47c07fcc946 /fs
parent52269718dc2cf2585d7a2828f31d46ef46e68000 (diff)
downloadlinux-bf2afee14e07de16d3cafc67edbfc2a3cc65e4bc.tar.xz
cifs: check rsp for NULL before dereferencing in SMB2_open
In SMB2_open there are several paths where the SendReceive2 call will return an error before it sets rsp_iov.iov_base thus leaving iov_base uninitialized. Thus we need to check rsp before we dereference it in the call to get_rfc1002_length(). A report of this issue was previously reported in http://www.spinics.net/lists/linux-cifs/msg12846.html RH-bugzilla : 1476151 Version 2 : * Lets properly initialize rsp_iov before we use it. Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com> Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>. Signed-off-by: Steve French <smfrench@gmail.com> Reported-by: Xiaoli Feng <xifeng@redhat.com> CC: Stable <stable@vger.kernel.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/cifs/smb2pdu.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5531e7ee1210..69a751b038ab 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1634,7 +1634,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
struct cifs_tcon *tcon = oparms->tcon;
struct cifs_ses *ses = tcon->ses;
struct kvec iov[4];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = {NULL, 0};
int resp_buftype;
int uni_path_len;
__le16 *copy_path = NULL;
@@ -1763,7 +1763,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
if (rc != 0) {
cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
- if (err_buf)
+ if (err_buf && rsp)
*err_buf = kmemdup(rsp, get_rfc1002_length(rsp) + 4,
GFP_KERNEL);
goto creat_exit;