]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
cifs: Fix invalid check in __cifs_calc_signature()
authorPaulo Alcantara <paulo@paulo.ac>
Fri, 15 Jun 2018 18:58:00 +0000 (15:58 -0300)
committerSteve French <stfrench@microsoft.com>
Sat, 16 Jun 2018 00:17:40 +0000 (19:17 -0500)
The following check would never evaluate to true:
  > if (i == 0 && iov[0].iov_len <= 4)

Because 'i' always starts at 1.

This patch fixes it and also move the header checks outside the for loop
- which makes more sense.

Signed-off-by: Paulo Alcantara <palcantara@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/cifs/cifsencrypt.c

index f23ff848b1581ee14f62021e572eed5b22e56190..ee2a8ec70056f7451695cb75bfe1e00a95280ff0 100644 (file)
@@ -48,26 +48,23 @@ int __cifs_calc_signature(struct smb_rqst *rqst,
 
        /* iov[0] is actual data and not the rfc1002 length for SMB2+ */
        if (is_smb2) {
-               rc = crypto_shash_update(shash,
-                                        iov[0].iov_base, iov[0].iov_len);
+               if (iov[0].iov_len <= 4)
+                       return -EIO;
+               i = 0;
        } else {
                if (n_vec < 2 || iov[0].iov_len != 4)
                        return -EIO;
+               i = 1; /* skip rfc1002 length */
        }
 
-       for (i = 1; i < n_vec; i++) {
+       for (; i < n_vec; i++) {
                if (iov[i].iov_len == 0)
                        continue;
                if (iov[i].iov_base == NULL) {
                        cifs_dbg(VFS, "null iovec entry\n");
                        return -EIO;
                }
-               if (is_smb2) {
-                       if (i == 0 && iov[0].iov_len <= 4)
-                               break; /* nothing to sign or corrupt header */
-               } else
-                       if (i == 1 && iov[1].iov_len <= 4)
-                               break; /* nothing to sign or corrupt header */
+
                rc = crypto_shash_update(shash,
                                         iov[i].iov_base, iov[i].iov_len);
                if (rc) {