Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9ac49d3 authored by Jeff Layton's avatar Jeff Layton Committed by Steve French
Browse files

cifs: make sure we allocate enough storage for socket address 



The sockaddr declared on the stack in cifs_get_tcp_session is too small
for IPv6 addresses. Change it from "struct sockaddr" to "struct
sockaddr_storage" to prevent stack corruption when IPv6 is used.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent da505c38

fs/cifs/connect.c

+8 −8
Original line number Original line Diff line number Diff line
@@ -1354,7 +1354,7 @@ cifs_parse_mount_options(char *options, const char *devname, 
}

}





static struct TCP_Server_Info *

static struct TCP_Server_Info *

cifs_find_tcp_session(struct sockaddr *addr)

cifs_find_tcp_session(struct sockaddr_storage *addr)

{

{

	struct list_head *tmp;

	struct list_head *tmp;

	struct TCP_Server_Info *server;

	struct TCP_Server_Info *server;
@@ -1374,11 +1374,11 @@ cifs_find_tcp_session(struct sockaddr *addr) 
		if (server->tcpStatus == CifsNew)

		if (server->tcpStatus == CifsNew)

			continue;

			continue;





		if (addr->sa_family == AF_INET &&

		if (addr->ss_family == AF_INET &&

		    (addr4->sin_addr.s_addr !=

		    (addr4->sin_addr.s_addr !=

		     server->addr.sockAddr.sin_addr.s_addr))

		     server->addr.sockAddr.sin_addr.s_addr))

			continue;

			continue;

		else if (addr->sa_family == AF_INET6 &&

		else if (addr->ss_family == AF_INET6 &&

			 memcmp(&server->addr.sockAddr6.sin6_addr,

			 memcmp(&server->addr.sockAddr6.sin6_addr,

				&addr6->sin6_addr, sizeof(addr6->sin6_addr)))

				&addr6->sin6_addr, sizeof(addr6->sin6_addr)))

			continue;

			continue;
@@ -1419,12 +1419,12 @@ static struct TCP_Server_Info * 
cifs_get_tcp_session(struct smb_vol *volume_info)

cifs_get_tcp_session(struct smb_vol *volume_info)

{

{

	struct TCP_Server_Info *tcp_ses = NULL;

	struct TCP_Server_Info *tcp_ses = NULL;

	struct sockaddr addr;

	struct sockaddr_storage addr;

	struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;

	struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;

	struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;

	struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;

	int rc;

	int rc;





	memset(&addr, 0, sizeof(struct sockaddr));

	memset(&addr, 0, sizeof(struct sockaddr_storage));





	if (volume_info->UNCip && volume_info->UNC) {

	if (volume_info->UNCip && volume_info->UNC) {

		rc = cifs_inet_pton(AF_INET, volume_info->UNCip,

		rc = cifs_inet_pton(AF_INET, volume_info->UNCip,
@@ -1435,9 +1435,9 @@ cifs_get_tcp_session(struct smb_vol *volume_info) 
			rc = cifs_inet_pton(AF_INET6, volume_info->UNCip,

			rc = cifs_inet_pton(AF_INET6, volume_info->UNCip,

					    &sin_server6->sin6_addr.in6_u);

					    &sin_server6->sin6_addr.in6_u);

			if (rc > 0)

			if (rc > 0)

				addr.sa_family = AF_INET6;

				addr.ss_family = AF_INET6;

		} else {

		} else {

			addr.sa_family = AF_INET;

			addr.ss_family = AF_INET;

		}

		}





		if (rc <= 0) {

		if (rc <= 0) {
@@ -1502,7 +1502,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info) 
	tcp_ses->tcpStatus = CifsNew;

	tcp_ses->tcpStatus = CifsNew;

	++tcp_ses->srv_count;

	++tcp_ses->srv_count;





	if (addr.sa_family == AF_INET6) {

	if (addr.ss_family == AF_INET6) {

		cFYI(1, ("attempting ipv6 connect"));

		cFYI(1, ("attempting ipv6 connect"));

		/* BB should we allow ipv6 on port 139? */

		/* BB should we allow ipv6 on port 139? */

		/* other OS never observed in Wild doing 139 with v6 */

		/* other OS never observed in Wild doing 139 with v6 */