From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Jeff Layton <jlayton@redhat.com>,
Steve French <sfrench@us.ibm.com>
Subject: [ 16/82] cifs: ensure that cifs_get_root() only traverses directories
Date: Mon, 18 Mar 2013 04:22:00 +0000 [thread overview]
Message-ID: <20130318042145.861311995@decadent.org.uk> (raw)
In-Reply-To: <20130318042144.234468645@decadent.org.uk>
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@redhat.com>
commit ce2ac52105aa663056dfc17966ebed1bf93e6e64 upstream.
Kjell Braden reported this oops:
[ 833.211970] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 833.212816] IP: [< (null)>] (null)
[ 833.213280] PGD 1b9b2067 PUD e9f7067 PMD 0
[ 833.213874] Oops: 0010 [#1] SMP
[ 833.214344] CPU 0
[ 833.214458] Modules linked in: des_generic md4 nls_utf8 cifs vboxvideo drm snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq bnep rfcomm snd_timer bluetooth snd_seq_device ppdev snd vboxguest parport_pc joydev mac_hid soundcore snd_page_alloc psmouse i2c_piix4 serio_raw lp parport usbhid hid e1000
[ 833.215629]
[ 833.215629] Pid: 1752, comm: mount.cifs Not tainted 3.0.0-rc7-bisectcifs-fec11dd9a0+ #18 innotek GmbH VirtualBox/VirtualBox
[ 833.215629] RIP: 0010:[<0000000000000000>] [< (null)>] (null)
[ 833.215629] RSP: 0018:ffff8800119c9c50 EFLAGS: 00010282
[ 833.215629] RAX: ffffffffa02186c0 RBX: ffff88000c427780 RCX: 0000000000000000
[ 833.215629] RDX: 0000000000000000 RSI: ffff88000c427780 RDI: ffff88000c4362e8
[ 833.215629] RBP: ffff8800119c9c88 R08: ffff88001fc15e30 R09: 00000000d69515c7
[ 833.215629] R10: ffffffffa0201972 R11: ffff88000e8f6a28 R12: ffff88000c4362e8
[ 833.215629] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88001181aaa6
[ 833.215629] FS: 00007f2986171700(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000
[ 833.215629] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 833.215629] CR2: 0000000000000000 CR3: 000000001b982000 CR4: 00000000000006f0
[ 833.215629] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 833.215629] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 833.215629] Process mount.cifs (pid: 1752, threadinfo ffff8800119c8000, task ffff88001c1c16f0)
[ 833.215629] Stack:
[ 833.215629] ffffffff8116a9b5 ffff8800119c9c88 ffffffff81178075 0000000000000286
[ 833.215629] 0000000000000000 ffff88000c4276c0 ffff8800119c9ce8 ffff8800119c9cc8
[ 833.215629] ffffffff8116b06e ffff88001bc6fc00 ffff88000c4276c0 ffff88000c4276c0
[ 833.215629] Call Trace:
[ 833.215629] [<ffffffff8116a9b5>] ? d_alloc_and_lookup+0x45/0x90
[ 833.215629] [<ffffffff81178075>] ? d_lookup+0x35/0x60
[ 833.215629] [<ffffffff8116b06e>] __lookup_hash.part.14+0x9e/0xc0
[ 833.215629] [<ffffffff8116b1d6>] lookup_one_len+0x146/0x1e0
[ 833.215629] [<ffffffff815e4f7e>] ? _raw_spin_lock+0xe/0x20
[ 833.215629] [<ffffffffa01eef0d>] cifs_do_mount+0x26d/0x500 [cifs]
[ 833.215629] [<ffffffff81163bd3>] mount_fs+0x43/0x1b0
[ 833.215629] [<ffffffff8117d41a>] vfs_kern_mount+0x6a/0xd0
[ 833.215629] [<ffffffff8117e584>] do_kern_mount+0x54/0x110
[ 833.215629] [<ffffffff8117fdc2>] do_mount+0x262/0x840
[ 833.215629] [<ffffffff81108a0e>] ? __get_free_pages+0xe/0x50
[ 833.215629] [<ffffffff8117f9ca>] ? copy_mount_options+0x3a/0x180
[ 833.215629] [<ffffffff8118075d>] sys_mount+0x8d/0xe0
[ 833.215629] [<ffffffff815ece82>] system_call_fastpath+0x16/0x1b
[ 833.215629] Code: Bad RIP value.
[ 833.215629] RIP [< (null)>] (null)
[ 833.215629] RSP <ffff8800119c9c50>
[ 833.215629] CR2: 0000000000000000
[ 833.238525] ---[ end trace ec00758b8d44f529 ]---
When walking down the path on the server, it's possible to hit a
symlink. The path walking code assumes that the caller will handle that
situation properly, but cifs_get_root() isn't set up for it. This patch
prevents the oops by simply returning an error.
A better solution would be to try and chase the symlinks here, but that's
fairly complicated to handle.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=53221
Reported-and-tested-by: Kjell Braden <afflux@pentabarf.de>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/cifsfs.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -561,6 +561,11 @@ cifs_get_root(struct smb_vol *vol, struc
dentry = ERR_PTR(-ENOENT);
break;
}
+ if (!S_ISDIR(dir->i_mode)) {
+ dput(dentry);
+ dentry = ERR_PTR(-ENOTDIR);
+ break;
+ }
/* skip separators */
while (*s == sep)
next prev parent reply other threads:[~2013-03-18 4:31 UTC|newest]
Thread overview: 87+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-18 4:21 [ 00/82] 3.2.41-stable review Ben Hutchings
2013-03-18 4:21 ` [ 01/82] Revert "powerpc/eeh: Fix crash when adding a device in a slot with DDW" Ben Hutchings
2013-03-18 4:21 ` [ 02/82] btrfs: Init io_lock after cloning btrfs device struct Ben Hutchings
2013-03-18 4:21 ` [ 03/82] md: protect against crash upon fsync on ro array Ben Hutchings
2013-03-18 4:21 ` [ 04/82] NFS: Dont allow NFS silly-renamed files to be deleted, no signal Ben Hutchings
2013-03-18 4:21 ` [ 05/82] SUNRPC: Dont start the retransmission timer when out of socket space Ben Hutchings
2013-03-18 4:21 ` [ 06/82] [SCSI] storvsc: Initialize the sglist Ben Hutchings
2013-03-18 4:21 ` [ 07/82] [SCSI] dc395x: uninitialized variable in device_alloc() Ben Hutchings
2013-03-18 4:21 ` [ 08/82] ARM: VFP: fix emulation of second VFP instruction Ben Hutchings
2013-03-18 4:21 ` [ 09/82] ARM: fix scheduling while atomic warning in alignment handling code Ben Hutchings
2013-03-18 4:21 ` [ 10/82] md: fix two bugs when attempting to resize RAID0 array Ben Hutchings
2013-03-18 4:21 ` [ 11/82] md: raid0: fix error return from create_stripe_zones Ben Hutchings
2013-03-18 4:21 ` [ 12/82] proc connector: reject unprivileged listener bumps Ben Hutchings
2013-03-18 4:21 ` [ 13/82] ath9k: fix RSSI dummy marker value Ben Hutchings
2013-03-18 4:21 ` [ 14/82] ath9k_htc: fix signal strength handling issues Ben Hutchings
2013-03-18 4:21 ` [ 15/82] mwifiex: correct sleep delay counter Ben Hutchings
2013-03-18 4:22 ` Ben Hutchings [this message]
2013-03-18 4:22 ` [ 17/82] xen/pci: We dont do multiple MSIs Ben Hutchings
2013-03-18 4:22 ` [ 18/82] dm: fix truncated status strings Ben Hutchings
2013-03-18 4:22 ` [ 19/82] dm snapshot: add missing module aliases Ben Hutchings
2013-03-18 4:22 ` [ 20/82] drm/i915: Dont clobber crtc->fb when queue_flip fails Ben Hutchings
2013-03-18 4:22 ` [ 21/82] ARM: 7663/1: perf: fix ARMv7 EVTYPE_MASK to include NSH bit Ben Hutchings
2013-03-18 4:22 ` [ 22/82] hwmon: (pmbus/ltc2978) Fix peak attribute handling Ben Hutchings
2013-03-18 4:22 ` [ 23/82] hwmon: (pmbus/ltc2978) Use detected chip ID to select supported functionality Ben Hutchings
2013-03-18 4:22 ` [ 24/82] hwmon: (sht15) Check return value of regulator_enable() Ben Hutchings
2013-03-18 4:22 ` [ 25/82] hw_random: make buffer usable in scatterlist Ben Hutchings
2013-03-18 4:22 ` [ 26/82] ALSA: vmaster: Fix slave change notification Ben Hutchings
2013-03-18 4:22 ` [ 27/82] drm/radeon: add primary dac adj quirk for R200 board Ben Hutchings
2013-03-18 4:22 ` [ 28/82] dmi_scan: fix missing check for _DMI_ signature in smbios_present() Ben Hutchings
2013-03-18 4:22 ` [ 29/82] iwlwifi: always copy first 16 bytes of commands Ben Hutchings
2013-03-18 4:22 ` [ 30/82] HID: add support for Sony RF receiver with USB product id 0x0374 Ben Hutchings
2013-03-18 4:22 ` [ 31/82] HID: clean up quirk for Sony RF receivers Ben Hutchings
2013-03-18 4:22 ` [ 32/82] ahci: AHCI-mode SATA patch for Intel Lynx Point DeviceIDs Ben Hutchings
2013-03-18 4:22 ` [ 33/82] ahci: Add Device IDs for Intel Lynx Point-LP PCH Ben Hutchings
2013-03-18 4:22 ` [ 34/82] ahci: AHCI-mode SATA patch for Intel Avoton DeviceIDs Ben Hutchings
2013-03-18 4:22 ` [ 35/82] ahci: Add Device IDs for Intel Wellsburg PCH Ben Hutchings
2013-03-18 4:22 ` [ 36/82] iommu/amd: Initialize device table after dma_ops Ben Hutchings
2013-03-18 4:22 ` [ 37/82] tty: Correct tty buffer flush Ben Hutchings
2013-03-18 4:22 ` [ 38/82] efi_pstore: Check remaining space with QueryVariableInfo() before writing data Ben Hutchings
2013-03-18 4:22 ` [ 39/82] efivars: Disable external interrupt while holding efivars->lock Ben Hutchings
2013-03-18 4:22 ` [ 40/82] efi: be more paranoid about available space when creating variables Ben Hutchings
2013-03-18 4:22 ` [ 41/82] ftrace: Update the kconfig for DYNAMIC_FTRACE Ben Hutchings
2013-03-18 4:22 ` [ 42/82] decnet: Fix disappearing sysctl entries Ben Hutchings
2013-03-18 4:22 ` [ 43/82] Fix memory leak in cpufreq stats Ben Hutchings
2013-03-18 4:22 ` [ 44/82] vfs: fix pipe counter breakage Ben Hutchings
2013-03-18 4:22 ` [ 45/82] USB: EHCI: dont check DMA values in QH overlays Ben Hutchings
2013-03-19 3:09 ` Ben Hutchings
2013-03-19 15:27 ` Alan Stern
2013-03-19 20:31 ` Ben Hutchings
2013-03-18 4:22 ` [ 46/82] xen/pciback: Dont disable a PCI device that is already disabled Ben Hutchings
2013-03-18 4:22 ` [ 47/82] USB: option: add Huawei E5331 Ben Hutchings
2013-03-18 4:22 ` [ 48/82] USB: storage: fix Huawei mode switching regression Ben Hutchings
2013-03-18 4:22 ` [ 49/82] USB: added support for Cinterions products AH6 and PLS8 Ben Hutchings
2013-03-18 4:22 ` [ 50/82] e1000e: fix pci-device enable-counter balance Ben Hutchings
2013-03-18 4:22 ` [ 51/82] virtio: rng: disallow multiple device registrations, fixes crashes Ben Hutchings
2013-03-18 4:22 ` [ 52/82] ALSA: seq: Fix missing error handling in snd_seq_timer_open() Ben Hutchings
2013-03-18 4:22 ` [ 53/82] usb: cp210x new Vendor/Device IDs Ben Hutchings
2013-03-18 4:22 ` [ 54/82] staging: vt6656: Fix oops on resume from suspend Ben Hutchings
2013-03-18 4:22 ` [ 55/82] qcaux: add Franklin U600 Ben Hutchings
2013-03-18 4:22 ` [ 56/82] ext3: Fix format string issues Ben Hutchings
2013-03-18 4:22 ` [ 57/82] keys: fix race with concurrent install_user_keyrings() Ben Hutchings
2013-03-18 4:22 ` [ 58/82] tty/serial: Add support for Altera serial port Ben Hutchings
2013-03-18 4:22 ` [ 59/82] Fix 4 port and add support for 8 port Unknown PCI serial port cards Ben Hutchings
2013-03-18 4:22 ` [ 60/82] serial: 8250_pci: add support for another kind of NetMos Technology PCI 9835 Multi-I/O Controller Ben Hutchings
2013-03-18 4:22 ` [ 61/82] tty: serial: fix typo "ARCH_S5P6450" Ben Hutchings
2013-03-18 4:22 ` [ 62/82] usb: serial: Add Rigblaster Advantage to device table Ben Hutchings
2013-03-18 4:22 ` [ 63/82] w1: fix oops when w1_search is called from netlink connector Ben Hutchings
2013-03-18 4:22 ` [ 64/82] USB: cdc-wdm: fix buffer overflow Ben Hutchings
2013-03-18 4:22 ` [ 65/82] signal: always clear sa_restorer on execve Ben Hutchings
2013-03-18 4:22 ` [ 66/82] hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes Ben Hutchings
2013-03-18 4:22 ` [ 67/82] hwmon: (pmbus/ltc2978) Fix temperature reporting Ben Hutchings
2013-03-18 4:22 ` [ 68/82] crypto: user - fix info leaks in report API Ben Hutchings
2013-03-18 4:22 ` [ 69/82] Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys Ben Hutchings
2013-03-18 4:22 ` [ 70/82] USB: Dont use EHCI port sempahore for USB 3.0 hubs Ben Hutchings
2013-03-18 4:22 ` [ 71/82] USB: Prepare for refactoring by adding extra udev checks Ben Hutchings
2013-03-18 4:22 ` [ 72/82] USB: Rip out recursive call on warm port reset Ben Hutchings
2013-03-18 4:22 ` [ 73/82] USB: Fix connected device switch to Inactive state Ben Hutchings
2013-03-18 4:22 ` [ 74/82] batman-adv: bat_socket_read missing checks Ben Hutchings
2013-03-18 4:22 ` [ 75/82] batman-adv: Only write requested number of byte to user buffer Ben Hutchings
2013-03-18 4:23 ` [ 76/82] mm/hotplug: correctly add new zone to all other nodes zone lists Ben Hutchings
2013-03-18 4:23 ` [ 77/82] xen-netfront: delay gARP until backend switches to Connected Ben Hutchings
2013-03-18 4:23 ` [ 78/82] block: use i_size_write() in bd_set_size() Ben Hutchings
2013-03-18 4:23 ` [ 79/82] loopdev: fix a deadlock Ben Hutchings
2013-03-18 4:23 ` [ 80/82] loopdev: remove an user triggerable oops Ben Hutchings
2013-03-18 4:23 ` [ 81/82] btrfs: use rcu_barrier() to wait for bdev puts at unmount Ben Hutchings
2013-03-18 4:23 ` [ 82/82] NLS: improve UTF8 -> UTF16 string conversion routine Ben Hutchings
2013-03-18 5:00 ` [ 00/82] 3.2.41-stable review Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130318042145.861311995@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=jlayton@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sfrench@us.ibm.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®