Commit 0a528a60 authored by ChenXiaoSong's avatar ChenXiaoSong Committed by Li Lingfeng
Browse files

smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() 

mainline inclusion
from mainline-v6.11-rc5
commit 4e8771a3666c8f216eefd6bd2fd50121c6c437db
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWV6
CVE: CVE-2024-46742

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4e8771a3666c8f216eefd6bd2fd50121c6c437db



--------------------------------

null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE)
and parse_lease_state() return NULL.

Fix this by check if 'lease_ctx_info' is NULL.

Additionally, remove the redundant parentheses in
parse_durable_handle_context().

Signed-off-by: default avatarChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>

Conflicts:
  fs/smb/server/oplock.c
  fs/smb/server/smb2pdu.c
[Commit c8efcc786146 ("ksmbd: add support for durable handles v1/v2") add
parse_durable_handle_context();
Commit 38c8a9a5 ("smb: move client and server files to common
directory fs/smb") move oplock.c and smb2pdu.c from fs/ksmbd/ to
fs/smb/server/.]
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent b3178bd9

fs/ksmbd/oplock.c

+1 −1
Original line number Diff line number Diff line
@@ -1389,7 +1389,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) 
 * parse_lease_state() - parse lease context containted in file open request

 * @open_req:	buffer containing smb2 file open(create) request

 *

 * Return:  oplock state, -ENOENT if create lease context not found

 * Return:  allocated lease context object on success, otherwise NULL

 */

struct lease_ctx_info *parse_lease_state(void *open_req)

{

fs/ksmbd/smb2pdu.c

+1 −1
Original line number Diff line number Diff line
@@ -3115,7 +3115,7 @@ int smb2_open(struct ksmbd_work *work) 
			goto err_out;

		}

	} else {

		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) {

		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) {

			req_op_level = smb2_map_lease_to_oplock(lc->req_state);

			ksmbd_debug(SMB,

				    "lease req for(%s) req oplock state 0x%x, lease state 0x%x\n",