[CIFS] Check that last search entry resume key is valid

Jeff's recent patch to add a last_entry field in the search structure
to better construct resume keys did not validate that the server
sent us a plausible pointer to the last entry.  This adds that.

Signed-off-by: Steve French <sfrench@us.ibm.com>

1 files changed, 24 insertions, 3 deletions

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 7b00a16e1352..6f4ffe15d68d 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3614,6 +3614,8 @@ findFirstRetry:
                 /* BB remember to free buffer if error BB */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
                 if (rc == 0) {
+                        unsigned int lnoff;
+
                         if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE)
                                 psrch_inf->unicode = true;
                         else
@@ -3636,8 +3638,17 @@ findFirstRetry:
                                         le16_to_cpu(parms->SearchCount);
                         psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
                                 psrch_inf->entries_in_buffer;
+                        lnoff = le16_to_cpu(parms->LastNameOffset);
+                        if (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE <
+                              lnoff) {
+                                cERROR(1, ("ignoring corrupt resume name"));
+                                psrch_inf->last_entry = NULL;
+                                return rc;
+                        }
+
                         psrch_inf->last_entry = psrch_inf->srch_entries_start +
-                                        le16_to_cpu(parms->LastNameOffset);
+                                                        lnoff;
+
                         *pnetfid = parms->SearchHandle;
                 } else {
                         cifs_buf_release(pSMB);
@@ -3727,6 +3738,8 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
                 if (rc == 0) {
+                        unsigned int lnoff;
+
                         /* BB fixme add lock for file (srch_info) struct here */
                         if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE)
                                 psrch_inf->unicode = true;
@@ -3753,8 +3766,16 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
                                                 le16_to_cpu(parms->SearchCount);
                         psrch_inf->index_of_last_entry +=
                                 psrch_inf->entries_in_buffer;
-                        psrch_inf->last_entry = psrch_inf->srch_entries_start +
-                                        le16_to_cpu(parms->LastNameOffset);
+                        lnoff = le16_to_cpu(parms->LastNameOffset);
+                        if (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE <
+                              lnoff) {
+                                cERROR(1, ("ignoring corrupt resume name"));
+                                psrch_inf->last_entry = NULL;
+                                return rc;
+                        } else
+                                psrch_inf->last_entry =
+                                        psrch_inf->srch_entries_start + lnoff;
+
 /*  cFYI(1,("fnxt2 entries in buf %d index_of_last %d",
             psrch_inf->entries_in_buffer, psrch_inf->index_of_last_entry)); */