Commit 25108594 authored by Roman Smirnov's avatar Roman Smirnov Committed by Steve French
Browse files

cifs: fix integer overflow in match_server() 



The echo_interval is not limited in any way during mounting,
which makes it possible to write a large number to it. This can
cause an overflow when multiplying ctx->echo_interval by HZ in
match_server().

Add constraints for echo_interval to smb3_fs_context_parse_param().

Found by Linux Verification Center (linuxtesting.org) with Svace.

Fixes: adfeb3e0 ("cifs: Make echo interval tunable")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarRoman Smirnov <r.smirnov@omp.ru>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 8b175e2e

fs/smb/client/fs_context.c

+5 −0
Original line number Diff line number Diff line
@@ -1383,6 +1383,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, 
		ctx->closetimeo = HZ * result.uint_32;

		break;

	case Opt_echo_interval:

		if (result.uint_32 < SMB_ECHO_INTERVAL_MIN ||

		    result.uint_32 > SMB_ECHO_INTERVAL_MAX) {

			cifs_errorf(fc, "echo interval is out of bounds\n");

			goto cifs_parse_mount_err;

		}

		ctx->echo_interval = result.uint_32;

		break;

	case Opt_snapshot: