Commit 4e8771a3 authored by ChenXiaoSong's avatar ChenXiaoSong Committed by Steve French
Browse files

smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() 



null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE)
and parse_lease_state() return NULL.

Fix this by check if 'lease_ctx_info' is NULL.

Additionally, remove the redundant parentheses in
parse_durable_handle_context().

Signed-off-by: default avatarChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 2186a116

fs/smb/server/oplock.c

+1 −1
Original line number Diff line number Diff line
@@ -1510,7 +1510,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) 
 * parse_lease_state() - parse lease context containted in file open request

 * @open_req:	buffer containing smb2 file open(create) request

 *

 * Return:  oplock state, -ENOENT if create lease context not found

 * Return: allocated lease context object on success, otherwise NULL

 */

struct lease_ctx_info *parse_lease_state(void *open_req)

{

fs/smb/server/smb2pdu.c

+5 −5
Original line number Diff line number Diff line
@@ -2770,8 +2770,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, 
				}

			}



			if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			     req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) {

			if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			    req_op_level == SMB2_OPLOCK_LEVEL_BATCH) {

				dh_info->CreateGuid =

					durable_v2_blob->CreateGuid;

				dh_info->persistent =
@@ -2791,8 +2791,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, 
				goto out;

			}



			if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			     req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) {

			if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||

			    req_op_level == SMB2_OPLOCK_LEVEL_BATCH) {

				ksmbd_debug(SMB, "Request for durable open\n");

				dh_info->type = dh_idx;

			}
@@ -3414,7 +3414,7 @@ int smb2_open(struct ksmbd_work *work) 
			goto err_out1;

		}

	} else {

		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) {

		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) {

			if (S_ISDIR(file_inode(filp)->i_mode)) {

				lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE;

				lc->is_dir = true;