Check minimum response length on query_network_interface

[mirror_ubuntu-bionic-kernel.git] / fs / cifs / smb2ops.c

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 5a48aa290dfe83fdab6f9af322aadcdd0ebe3b3b..c5f521bcdee247cf0ffc2b2f5af936467fd778aa 100644 (file)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -265,15 +265,18 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
                        FSCTL_QUERY_NETWORK_INTERFACE_INFO, true /* is_fsctl */,
                        NULL /* no data input */, 0 /* no data input */,
                        (char **)&out_buf, &ret_data_len);
-
-       if ((rc == 0)  && (ret_data_len > 0)) {
+       if (rc != 0)
+               cifs_dbg(VFS, "error %d on ioctl to get interface list\n", rc);
+       else if (ret_data_len < sizeof(struct network_interface_info_ioctl_rsp)) {
+               cifs_dbg(VFS, "server returned bad net interface info buf\n");
+               rc = -EINVAL;
+       } else {
                /* Dump info on first interface */
                cifs_dbg(FYI, "Adapter Capability 0x%x\t",
                        le32_to_cpu(out_buf->Capability));
                cifs_dbg(FYI, "Link Speed %lld\n",
                        le64_to_cpu(out_buf->LinkSpeed));
-       } else
-               cifs_dbg(VFS, "error %d on ioctl to get interface list\n", rc);
+       }
 
        return rc;
 }
@@ -389,7 +392,7 @@ smb2_query_file_info(const unsigned int xid, struct cifs_tcon *tcon,
        int rc;
        struct smb2_file_all_info *smb2_data;
 
-       smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+       smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
                            GFP_KERNEL);
        if (smb2_data == NULL)
                return -ENOMEM;
@@ -711,23 +714,23 @@ smb2_read_data_length(char *buf)
 
 
 static int
-smb2_sync_read(const unsigned int xid, struct cifsFileInfo *cfile,
+smb2_sync_read(const unsigned int xid, struct cifs_fid *pfid,
               struct cifs_io_parms *parms, unsigned int *bytes_read,
               char **buf, int *buf_type)
 {
-       parms->persistent_fid = cfile->fid.persistent_fid;
-       parms->volatile_fid = cfile->fid.volatile_fid;
+       parms->persistent_fid = pfid->persistent_fid;
+       parms->volatile_fid = pfid->volatile_fid;
        return SMB2_read(xid, parms, bytes_read, buf, buf_type);
 }
 
 static int
-smb2_sync_write(const unsigned int xid, struct cifsFileInfo *cfile,
+smb2_sync_write(const unsigned int xid, struct cifs_fid *pfid,
                struct cifs_io_parms *parms, unsigned int *written,
                struct kvec *iov, unsigned long nr_segs)
 {
 
-       parms->persistent_fid = cfile->fid.persistent_fid;
-       parms->volatile_fid = cfile->fid.volatile_fid;
+       parms->persistent_fid = pfid->persistent_fid;
+       parms->volatile_fid = pfid->volatile_fid;
        return SMB2_write(xid, parms, written, iov, nr_segs);
 }
 
@@ -1035,7 +1038,7 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
                if (keep_size == false)
                        return -EOPNOTSUPP;
 
-       /* 
+       /*
         * Must check if file sparse since fallocate -z (zero range) assumes
         * non-sparse allocation
         */
@@ -1452,6 +1455,8 @@ struct smb_version_operations smb21_operations = {
        .rename = smb2_rename_path,
        .create_hardlink = smb2_create_hardlink,
        .query_symlink = smb2_query_symlink,
+       .query_mf_symlink = smb3_query_mf_symlink,
+       .create_mf_symlink = smb3_create_mf_symlink,
        .open = smb2_open_file,
        .set_fid = smb2_set_fid,
        .close = smb2_close_file,
@@ -1531,6 +1536,8 @@ struct smb_version_operations smb30_operations = {
        .rename = smb2_rename_path,
        .create_hardlink = smb2_create_hardlink,
        .query_symlink = smb2_query_symlink,
+       .query_mf_symlink = smb3_query_mf_symlink,
+       .create_mf_symlink = smb3_create_mf_symlink,
        .open = smb2_open_file,
        .set_fid = smb2_set_fid,
        .close = smb2_close_file,