Commit bedc8f76 authored by Stefan Metzmacher's avatar Stefan Metzmacher Committed by Steve French
Browse files

cifs: always initialize struct msghdr smb_msg completely 



So far we were just lucky because the uninitialized members
of struct msghdr are not used by default on a SOCK_STREAM tcp
socket.

But as new things like msg_ubuf and sg_from_iter where added
recently, we should play on the safe side and avoid potention
problems in future.

Signed-off-by: default avatarStefan Metzmacher <metze@samba.org>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarPaulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 17d3df38

fs/cifs/connect.c

+3 −8
Original line number Diff line number Diff line
@@ -702,9 +702,6 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg) 
	int length = 0;

	int total_read;



	smb_msg->msg_control = NULL;

	smb_msg->msg_controllen = 0;



	for (total_read = 0; msg_data_left(smb_msg); total_read += length) {

		try_to_freeze();
@@ -760,7 +757,7 @@ int 
cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,

		      unsigned int to_read)

{

	struct msghdr smb_msg;

	struct msghdr smb_msg = {};

	struct kvec iov = {.iov_base = buf, .iov_len = to_read};

	iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read);
@@ -770,15 +767,13 @@ cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, 
ssize_t

cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read)

{

	struct msghdr smb_msg;

	struct msghdr smb_msg = {};



	/*

	 *  iov_iter_discard already sets smb_msg.type and count and iov_offset

	 *  and cifs_readv_from_socket sets msg_control and msg_controllen

	 *  so little to initialize in struct msghdr

	 */

	smb_msg.msg_name = NULL;

	smb_msg.msg_namelen = 0;

	iov_iter_discard(&smb_msg.msg_iter, READ, to_read);



	return cifs_readv_from_socket(server, &smb_msg);
@@ -788,7 +783,7 @@ int 
cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page,

	unsigned int page_offset, unsigned int to_read)

{

	struct msghdr smb_msg;

	struct msghdr smb_msg = {};

	struct bio_vec bv = {

		.bv_page = page, .bv_len = to_read, .bv_offset = page_offset};

	iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read);

fs/cifs/transport.c

+1 −5
Original line number Diff line number Diff line
@@ -194,10 +194,6 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg, 


	*sent = 0;



	smb_msg->msg_name = NULL;

	smb_msg->msg_namelen = 0;

	smb_msg->msg_control = NULL;

	smb_msg->msg_controllen = 0;

	if (server->noblocksnd)

		smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;

	else
@@ -309,7 +305,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, 
	sigset_t mask, oldmask;

	size_t total_len = 0, sent, size;

	struct socket *ssocket = server->ssocket;

	struct msghdr smb_msg;

	struct msghdr smb_msg = {};

	__be32 rfc1002_marker;



	if (cifs_rdma_enabled(server)) {