RE: [PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-07 Thread David Laight
From: Christoph Probst > Sent: 07 May 2019 07:10 > Steve French schrieb am 06.05.2019 um 23:18 Uhr: > > > On Mon, May 6, 2019 at 2:03 PM Pavel Shilovsky > > wrote: > > > > > > The patch itself is fine but I think we have a bigger problem here: > > > > Good point. Perhaps make update to the same

Re: [PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-06 Thread Christoph Probst
Steve French schrieb am 06.05.2019 um 23:18 Uhr: > On Mon, May 6, 2019 at 2:03 PM Pavel Shilovsky > wrote: > > > > The patch itself is fine but I think we have a bigger problem here: > > Good point. Perhaps make update to the same patch to include both changes I'll update my patch to impleme

Re: [PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-06 Thread Steve French
On Mon, May 6, 2019 at 2:03 PM Pavel Shilovsky wrote: > > The patch itself is fine but I think we have a bigger problem here: Good point. Perhaps make update to the same patch to include both changes > 3052 >---cinode->oplock = 0; > > here we reset oplock level of the inode, so forcing all

Re: [PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-06 Thread Pavel Shilovsky
The patch itself is fine but I think we have a bigger problem here: 3052 >---cinode->oplock = 0; here we reset oplock level of the inode, so forcing all the IO go to the server. 3053 >---if (oplock & SMB2_LEASE_READ_CACHING_HE) { 3054 >--->---cinode->oplock |= CIFS_CACHE_READ_FLG

Re: [PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-06 Thread Steve French
We could always switch it to strncpy :) In any case - he is correct, it is better than what was there because we should not strcat unless the array were locked across the whole function On Mon, May 6, 2019 at 11:57 AM Jeremy Allison wrote: > > On Mon, May 06, 2019 at 11:53:44AM -0500, Steve Fren

Re: [PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-06 Thread Jeremy Allison
On Mon, May 06, 2019 at 11:53:44AM -0500, Steve French via samba-technical wrote: > I think strcpy is clearer - but I don't think it can overflow since if > R, W or W were written to "message" then cinode->oplock would be > non-zero so we would never strcap "None" Ahem. In Samba we have : lib/ut

Re: [PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-06 Thread Steve French
I think strcpy is clearer - but I don't think it can overflow since if R, W or W were written to "message" then cinode->oplock would be non-zero so we would never strcap "None" On Mon, May 6, 2019 at 10:26 AM Christoph Probst wrote: > > Change strcat to strcpy in the "None" case as it is never va

[PATCH] cifs: fix strcat buffer overflow in smb21_set_oplock_level()

2019-05-06 Thread Christoph Probst
Change strcat to strcpy in the "None" case as it is never valid to append "None" to any other message. It may also overflow char message[5], in a race condition on cinode if cinode->oplock is unset by another thread after "RHW" or "RH" had been written to message. Signed-off-by: Christoph Probst