Commit 0e97fcf9 authored by Paulo Alcantara's avatar Paulo Alcantara Committed by Long Li
Browse files

smb: client: fix parsing of device numbers 

mainline inclusion
from mainline-v6.10-rc2
commit 663f295e35594f4c2584fc68c28546b747b637cd
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA3
CVE: CVE-2024-49996

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=663f295e35594f4c2584fc68c28546b747b637cd



--------------------------------

Report correct major and minor numbers from special files created with
NFS reparse points.

Signed-off-by: default avatarPaulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
parent 9d0af12b

fs/smb/client/reparse.c

+3 −3
Original line number Diff line number Diff line
@@ -468,7 +468,7 @@ static void wsl_to_fattr(struct cifs_open_info_data *data, 
		else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen))

			fattr->cf_mode = (umode_t)le32_to_cpu(*(__le32 *)v);

		else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen))

			fattr->cf_rdev = wsl_mkdev(v);

			fattr->cf_rdev = reparse_mkdev(v);

	} while (next);

out:

	fattr->cf_dtype = S_DT(fattr->cf_mode);
@@ -485,11 +485,11 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb, 
		switch (le64_to_cpu(buf->InodeType)) {

		case NFS_SPECFILE_CHR:

			fattr->cf_mode |= S_IFCHR;

			fattr->cf_rdev = reparse_nfs_mkdev(buf);

			fattr->cf_rdev = reparse_mkdev(buf->DataBuffer);

			break;

		case NFS_SPECFILE_BLK:

			fattr->cf_mode |= S_IFBLK;

			fattr->cf_rdev = reparse_nfs_mkdev(buf);

			fattr->cf_rdev = reparse_mkdev(buf->DataBuffer);

			break;

		case NFS_SPECFILE_FIFO:

			fattr->cf_mode |= S_IFIFO;

fs/smb/client/reparse.h

+1 −8
Original line number Diff line number Diff line
@@ -18,14 +18,7 @@ 
 */

#define IO_REPARSE_TAG_INTERNAL ((__u32)~0U)



static inline dev_t reparse_nfs_mkdev(struct reparse_posix_data *buf)

{

	u64 v = le64_to_cpu(*(__le64 *)buf->DataBuffer);



	return MKDEV(v >> 32, v & 0xffffffff);

}



static inline dev_t wsl_mkdev(void *ptr)

static inline dev_t reparse_mkdev(void *ptr)

{

	u64 v = le64_to_cpu(*(__le64 *)ptr);