rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

CVE-2012-1090 CIFS: fix dentry refcount leak when opening a FIFO on lookup (rhbz 798296)

This commit is contained in:
Justin M. Forbes 2012-02-28 11:34:10 -06:00
parent e14b40bbbd
commit 8a8688b231
2 changed files with 69 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch Normal file
View File

@ -0,0 +1,61 @@
From 5bccda0ebc7c0331b81ac47d39e4b920b198b2cd Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@redhat.com>
Date: Thu, 23 Feb 2012 09:37:45 -0500
Subject: [PATCH] cifs: fix dentry refcount leak when opening a FIFO on lookup
The cifs code will attempt to open files on lookup under certain
circumstances. What happens though if we find that the file we opened
was actually a FIFO or other special file?
Currently, the open filehandle just ends up being leaked leading to
a dentry refcount mismatch and oops on umount. Fix this by having the
code close the filehandle on the server if it turns out not to be a
regular file. While we're at it, change this spaghetti if statement
into a switch too.
Cc: stable@vger.kernel.org
Reported-by: CAI Qian <caiqian@redhat.com>
Tested-by: CAI Qian <caiqian@redhat.com>
Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
---
fs/cifs/dir.c | 20 ++++++++++++++++++--
1 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 63a196b..bc7e244 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -584,10 +584,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
* If either that or op not supported returned, follow
* the normal lookup.
*/
- if ((rc == 0) || (rc == -ENOENT))
+ switch (rc) {
+ case 0:
+ /*
+ * The server may allow us to open things like
+ * FIFOs, but the client isn't set up to deal
+ * with that. If it's not a regular file, just
+ * close it and proceed as if it were a normal
+ * lookup.
+ */
+ if (newInode && !S_ISREG(newInode->i_mode)) {
+ CIFSSMBClose(xid, pTcon, fileHandle);
+ break;
+ }
+ case -ENOENT:
posix_open = true;
- else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
+ case -EOPNOTSUPP:
+ break;
+ default:
pTcon->broken_posix_open = true;
+ }
}
if (!posix_open)
rc = cifs_get_inode_info_unix(&newInode, full_path,
--
1.7.0.4

9
kernel.spec
View File

@ -54,7 +54,7 @@ Summary: The Linux kernel
# For non-released -rc kernels, this will be appended after the rcX and
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
#
%global baserelease 1
%global baserelease 2
%global fedora_build %{baserelease}
# base_sublevel is the kernel version we're starting with and patching
@ -856,6 +856,7 @@ Patch50132: mac80211-zero-initialize-count-field-in-ieee80211_tx.patch
Patch50133: mac80211-Fix-a-warning-on-changing-to-monitor-mode-f.patch
Patch50134: brcm80211-smac-fix-endless-retry-of-A-MPDU-transmiss.patch
Patch50135: brcm80211-smac-only-print-block-ack-timeout-message-.patch
Patch50136: cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch
#rhbz 727865 730007
Patch21102: ACPICA-Fix-regression-in-FADT-revision-checks.patch
@ -1558,6 +1559,9 @@ ApplyPatch s390x-enable-keys-compat.patch
#rhbz 727865 730007
ApplyPatch ACPICA-Fix-regression-in-FADT-revision-checks.patch
#rhbz 798296
ApplyPatch cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch
# END OF PATCH APPLICATIONS
%endif
@ -2374,6 +2378,9 @@ fi
# and build.
%changelog
* Tue Feb 28 2012 Justin M. Forbes <jforbes@redhat.com> 3.2.8-2
- CVE-2012-1090 CIFS: fix dentry refcount leak when opening a FIFO on lookup (rhbz 798296)
* Mon Feb 27 2012 Josh Boyer <jwboyer@redhat.com> 3.2.8-1
- Linux 3.2.8