diff options
author | Jeff Layton <jlayton@redhat.com> | 2011-01-20 13:36:51 -0500 |
---|---|---|
committer | Steve French <sfrench@us.ibm.com> | 2011-01-20 16:47:54 -0500 |
commit | 26ec254869c0158ea8db6de83b7644e2d93cac2a (patch) | |
tree | c011b56ea2b519f8988b7965ab318e480a6c4fc9 /fs | |
parent | 12df83c9b901cfe8ca7a66fbe0effc6d873cbbb9 (diff) |
cifs: fix unaligned access in check2ndT2 and coalesce_t2
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Pavel Shilovsky <piastryyy@gmail.com>
Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/cifs/connect.c | 33 |
1 files changed, 14 insertions, 19 deletions
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index ca20e813275d..18d3c7724d6e 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c | |||
@@ -232,9 +232,8 @@ cifs_reconnect(struct TCP_Server_Info *server) | |||
232 | static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize) | 232 | static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize) |
233 | { | 233 | { |
234 | struct smb_t2_rsp *pSMBt; | 234 | struct smb_t2_rsp *pSMBt; |
235 | int total_data_size; | ||
236 | int data_in_this_rsp; | ||
237 | int remaining; | 235 | int remaining; |
236 | __u16 total_data_size, data_in_this_rsp; | ||
238 | 237 | ||
239 | if (pSMB->Command != SMB_COM_TRANSACTION2) | 238 | if (pSMB->Command != SMB_COM_TRANSACTION2) |
240 | return 0; | 239 | return 0; |
@@ -248,8 +247,8 @@ static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize) | |||
248 | 247 | ||
249 | pSMBt = (struct smb_t2_rsp *)pSMB; | 248 | pSMBt = (struct smb_t2_rsp *)pSMB; |
250 | 249 | ||
251 | total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount); | 250 | total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount); |
252 | data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount); | 251 | data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount); |
253 | 252 | ||
254 | remaining = total_data_size - data_in_this_rsp; | 253 | remaining = total_data_size - data_in_this_rsp; |
255 | 254 | ||
@@ -275,21 +274,18 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB) | |||
275 | { | 274 | { |
276 | struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond; | 275 | struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond; |
277 | struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB; | 276 | struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)pTargetSMB; |
278 | int total_data_size; | ||
279 | int total_in_buf; | ||
280 | int remaining; | ||
281 | int total_in_buf2; | ||
282 | char *data_area_of_target; | 277 | char *data_area_of_target; |
283 | char *data_area_of_buf2; | 278 | char *data_area_of_buf2; |
284 | __u16 byte_count; | 279 | int remaining; |
280 | __u16 byte_count, total_data_size, total_in_buf, total_in_buf2; | ||
285 | 281 | ||
286 | total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount); | 282 | total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount); |
287 | 283 | ||
288 | if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) { | 284 | if (total_data_size != |
285 | get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount)) | ||
289 | cFYI(1, "total data size of primary and secondary t2 differ"); | 286 | cFYI(1, "total data size of primary and secondary t2 differ"); |
290 | } | ||
291 | 287 | ||
292 | total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount); | 288 | total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount); |
293 | 289 | ||
294 | remaining = total_data_size - total_in_buf; | 290 | remaining = total_data_size - total_in_buf; |
295 | 291 | ||
@@ -299,25 +295,25 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB) | |||
299 | if (remaining == 0) /* nothing to do, ignore */ | 295 | if (remaining == 0) /* nothing to do, ignore */ |
300 | return 0; | 296 | return 0; |
301 | 297 | ||
302 | total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount); | 298 | total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount); |
303 | if (remaining < total_in_buf2) { | 299 | if (remaining < total_in_buf2) { |
304 | cFYI(1, "transact2 2nd response contains too much data"); | 300 | cFYI(1, "transact2 2nd response contains too much data"); |
305 | } | 301 | } |
306 | 302 | ||
307 | /* find end of first SMB data area */ | 303 | /* find end of first SMB data area */ |
308 | data_area_of_target = (char *)&pSMBt->hdr.Protocol + | 304 | data_area_of_target = (char *)&pSMBt->hdr.Protocol + |
309 | le16_to_cpu(pSMBt->t2_rsp.DataOffset); | 305 | get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); |
310 | /* validate target area */ | 306 | /* validate target area */ |
311 | 307 | ||
312 | data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol + | 308 | data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol + |
313 | le16_to_cpu(pSMB2->t2_rsp.DataOffset); | 309 | get_unaligned_le16(&pSMB2->t2_rsp.DataOffset); |
314 | 310 | ||
315 | data_area_of_target += total_in_buf; | 311 | data_area_of_target += total_in_buf; |
316 | 312 | ||
317 | /* copy second buffer into end of first buffer */ | 313 | /* copy second buffer into end of first buffer */ |
318 | memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2); | 314 | memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2); |
319 | total_in_buf += total_in_buf2; | 315 | total_in_buf += total_in_buf2; |
320 | pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf); | 316 | put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount); |
321 | byte_count = get_bcc_le(pTargetSMB); | 317 | byte_count = get_bcc_le(pTargetSMB); |
322 | byte_count += total_in_buf2; | 318 | byte_count += total_in_buf2; |
323 | put_bcc_le(byte_count, pTargetSMB); | 319 | put_bcc_le(byte_count, pTargetSMB); |
@@ -334,7 +330,6 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB) | |||
334 | return 0; /* we are done */ | 330 | return 0; /* we are done */ |
335 | } else /* more responses to go */ | 331 | } else /* more responses to go */ |
336 | return 1; | 332 | return 1; |
337 | |||
338 | } | 333 | } |
339 | 334 | ||
340 | static void | 335 | static void |