Commit 2585dc5a authored by Thiago Rafael Becker's avatar Thiago Rafael Becker Committed by Jialin Zhang
Browse files

cifs: sanitize multiple delimiters in prepath 

mainline inclusion
from mainline-v5.16-rc6
commit a3108089
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6D6RL
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a31080899d5fdafcccf7f39dd214a814a2c82626

--------------------------------

mount.cifs can pass a device with multiple delimiters in it. This will
cause rename(2) to fail with ENOENT.

V2:
  - Make sanitize_path more readable.
  - Fix multiple delimiters between UNC and prepath.
  - Avoid a memory leak if a bad user starts putting a lot of delimiters
    in the path on purpose.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2031200


Fixes: 24e0a1ef ("cifs: switch to new mount api")
Cc: stable@vger.kernel.org # 5.11+
Acked-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: default avatarThiago Rafael Becker <trbecker@gmail.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>

conflicts:
	fs/cifs/fs_context.c

Signed-off-by: default avatarZhaoLong Wang <wangzhaolong1@huawei.com>
Reviewed-by: default avatarZhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent 1f2d1a32

fs/cifs/connect.c

+37 −1
Original line number Diff line number Diff line
@@ -1316,6 +1316,42 @@ static int get_option_gid(substring_t args[], kgid_t *result) 
	return 0;

}



/*

 * Remove duplicate path delimiters. Windows is supposed to do that

 * but there are some bugs that prevent rename from working if there are

 * multiple delimiters.

 *

 * Returns a sanitized duplicate of @path. The caller is responsible for

 * cleaning up the original.

 */

#define IS_DELIM(c) ((c) == '/' || (c) == '\\')

static char *sanitize_path(char *path)

{

	char *cursor1 = path, *cursor2 = path;



	/* skip all prepended delimiters */

	while (IS_DELIM(*cursor1))

		cursor1++;



	/* copy the first letter */

	*cursor2 = *cursor1;



	/* copy the remainder... */

	while (*(cursor1++)) {

		/* ... skipping all duplicated delimiters */

		if (IS_DELIM(*cursor1) && IS_DELIM(*cursor2))

			continue;

		*(++cursor2) = *cursor1;

	}



	/* if the last character is a delimiter, skip it */

	if (IS_DELIM(*(cursor2 - 1)))

		cursor2--;



	*(cursor2) = '\0';

	return kstrdup(path, GFP_KERNEL);

}



/*

 * Parse a devname into substrings and populate the vol->UNC and vol->prepath

 * fields with the result. Returns 0 on success and an error otherwise.
@@ -1364,7 +1400,7 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol) 
	if (!*pos)

		return 0;



	vol->prepath = kstrdup(pos, GFP_KERNEL);

	vol->prepath = sanitize_path(pos);

	if (!vol->prepath)

		return -ENOMEM;