summaryrefslogtreecommitdiff
path: root/fs/cifs/file.c
diff options
context:
space:
mode:
authorSteve French <sfrench@us.ibm.com>2007-11-13 22:41:37 +0000
committerSteve French <sfrench@us.ibm.com>2007-11-13 22:41:37 +0000
commit133672efbc1085f9af990bdc145e1822ea93bcf3 (patch)
treeb93b5ba3a9559d137fe7fb86f6d1a3d33189ce0b /fs/cifs/file.c
parent9418d5dc9ba40b88737580457bf3b7c63c60ec43 (diff)
[CIFS] Fix buffer overflow if server sends corrupt response to small
request In SendReceive() function in transport.c - it memcpy's message payload into a buffer passed via out_buf param. The function assumes that all buffers are of size (CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) , unfortunately it is also called with smaller (MAX_CIFS_SMALL_BUFFER_SIZE) buffers. There are eight callers (SMB worker functions) which are primarily affected by this change: TreeDisconnect, uLogoff, Close, findClose, SetFileSize, SetFileTimes, Lock and PosixLock CC: Dave Kleikamp <shaggy@austin.ibm.com> CC: Przemyslaw Wegrzyn <czajnik@czajsoft.pl> Acked-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <sfrench@us.ibm.com>
Diffstat (limited to 'fs/cifs/file.c')
-rw-r--r--fs/cifs/file.c14
1 files changed, 7 insertions, 7 deletions
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 68ad4ca0cfa3..82326d2142e7 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -835,9 +835,9 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
xid = GetXid();
if (*poffset > file->f_path.dentry->d_inode->i_size)
- long_op = 2; /* writes past end of file can take a long time */
+ long_op = CIFS_VLONG_OP; /* writes past EOF take long time */
else
- long_op = 1;
+ long_op = CIFS_LONG_OP;
for (total_written = 0; write_size > total_written;
total_written += bytes_written) {
@@ -884,7 +884,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
}
} else
*poffset += bytes_written;
- long_op = FALSE; /* subsequent writes fast -
+ long_op = CIFS_STD_OP; /* subsequent writes fast -
15 seconds is plenty */
}
@@ -934,9 +934,9 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
xid = GetXid();
if (*poffset > file->f_path.dentry->d_inode->i_size)
- long_op = 2; /* writes past end of file can take a long time */
+ long_op = CIFS_VLONG_OP; /* writes past EOF can be slow */
else
- long_op = 1;
+ long_op = CIFS_LONG_OP;
for (total_written = 0; write_size > total_written;
total_written += bytes_written) {
@@ -1002,7 +1002,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
}
} else
*poffset += bytes_written;
- long_op = FALSE; /* subsequent writes fast -
+ long_op = CIFS_STD_OP; /* subsequent writes fast -
15 seconds is plenty */
}
@@ -1360,7 +1360,7 @@ retry:
open_file->netfid,
bytes_to_write, offset,
&bytes_written, iov, n_iov,
- 1);
+ CIFS_LONG_OP);
atomic_dec(&open_file->wrtPending);
if (rc || bytes_written < bytes_to_write) {
cERROR(1, ("Write2 ret %d, wrote %d",