Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db3b5474 authored by Aurélien Aptel's avatar Aurélien Aptel Committed by Steve French
Browse files

CIFS: Fix NULL pointer deref on SMB2_tcon() failure 



If SendReceive2() fails rsp is set to NULL but is dereferenced in the
error handling code.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarAurelien Aptel <aaptel@suse.com>
Reviewed-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent 48923d2a

fs/cifs/smb2pdu.c

+2 −2
Original line number Diff line number Diff line
@@ -1255,7 +1255,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 
	struct smb2_tree_connect_req *req;

	struct smb2_tree_connect_rsp *rsp = NULL;

	struct kvec iov[2];

	struct kvec rsp_iov;

	struct kvec rsp_iov = { NULL, 0 };

	int rc = 0;

	int resp_buftype;

	int unc_path_len;
@@ -1372,7 +1372,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 
	return rc;



tcon_error_exit:

	if (rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {

	if (rsp && rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {

		cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);

	}

	goto tcon_exit;