diff options
| author | Sachin Prabhu <sprabhu@redhat.com> | 2016-07-07 21:28:27 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-08-20 18:09:20 +0200 |
| commit | 36e6321056ba24f004bfc16d4398e65a6651f843 (patch) | |
| tree | 4b160b6001babf3fb80756d5ae5f0e703565c4a1 | |
| parent | a636a9b1306587bbfab54b1e435461289a4c2c35 (diff) | |
| download | linux-stable-36e6321056ba24f004bfc16d4398e65a6651f843.tar.gz linux-stable-36e6321056ba24f004bfc16d4398e65a6651f843.tar.bz2 linux-stable-36e6321056ba24f004bfc16d4398e65a6651f843.zip | |
cifs: Check for existing directory when opening file with O_CREAT
commit 8d9535b6efd86e6c07da59f97e68f44efb7fe080 upstream.
When opening a file with O_CREAT flag, check to see if the file opened
is an existing directory.
This prevents the directory from being opened which subsequently causes
a crash when the close function for directories cifs_closedir() is called
which frees up the file->private_data memory while the file is still
listed on the open file list for the tcon.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Reported-by: Xiaoli Feng <xifeng@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/cifs/dir.c | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c index b95bffcee8aa..26a3b389a265 100644 --- a/fs/cifs/dir.c +++ b/fs/cifs/dir.c @@ -245,6 +245,13 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, goto cifs_create_get_file_info; } + if (S_ISDIR(newinode->i_mode)) { + CIFSSMBClose(xid, tcon, fid->netfid); + iput(newinode); + rc = -EISDIR; + goto out; + } + if (!S_ISREG(newinode->i_mode)) { /* * The server may allow us to open things like @@ -415,10 +422,14 @@ cifs_create_set_dentry: if (rc != 0) { cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n", rc); - if (server->ops->close) - server->ops->close(xid, tcon, fid); - goto out; + goto out_err; } + + if (S_ISDIR(newinode->i_mode)) { + rc = -EISDIR; + goto out_err; + } + d_drop(direntry); d_add(direntry, newinode); @@ -426,6 +437,13 @@ out: kfree(buf); kfree(full_path); return rc; + +out_err: + if (server->ops->close) + server->ops->close(xid, tcon, fid); + if (newinode) + iput(newinode); + goto out; } int |