Re: [PATCH] cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting

Steve French smfrench@gmail.com writes:

On Thu, Jul 5, 2018 at 9:35 AM Aurélien Aptel aaptel@suse.com wrote:

...

Stefano Brivio sbrivio@redhat.com writes:

...

  /* BB eventually switch this to SMB2 specific small buf size */

• *request_buf = cifs_small_buf_get();
  

• if (smb2_command == SMB2_SET_INFO)
  

•         *request_buf = cifs_buf_get();
  

• else
  

•         *request_buf = cifs_small_buf_get();
  if (*request_buf == NULL) {
          /* BB should we add a retry in here if not a writepage? */
          return -ENOMEM;
  

@@ -3720,7 +3723,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,

  rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
                      &rsp_iov);

• cifs_small_buf_release(req);
  

• cifs_buf_release(req);
  rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
  

Small and large bufs use different mempools, shouldn't the release func match the get func?

Yes

Stefano, Can you respin your patch? I am hoping this patch addresses a bug I have been seeing

I've ran xfstests with the 2 patches on top (smb3 section only again) I get good results less failures than v4.17 :)

Failures: generic/112 generic/123 generic/128 generic/210 generic/323 generic/355 generic/378 generic/469 generic/478 generic/484 generic/486 Failed 11 of 394 tests

Cheers,