From patchwork Thu Jan 27 12:47:56 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Layton X-Patchwork-Id: 512011 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p0RCm14M011741 for ; Thu, 27 Jan 2011 12:48:05 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752877Ab1A0MsF (ORCPT ); Thu, 27 Jan 2011 07:48:05 -0500 Received: from mail-yw0-f46.google.com ([209.85.213.46]:37132 "EHLO mail-yw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752812Ab1A0MsE (ORCPT ); Thu, 27 Jan 2011 07:48:04 -0500 Received: by mail-yw0-f46.google.com with SMTP id 10so559749ywe.19 for ; Thu, 27 Jan 2011 04:48:04 -0800 (PST) Received: by 10.100.240.20 with SMTP id n20mr573735anh.94.1296132481410; Thu, 27 Jan 2011 04:48:01 -0800 (PST) Received: from salusa.poochiereds.net (cpe-071-070-153-003.nc.res.rr.com [71.70.153.3]) by mx.google.com with ESMTPS id b27sm20389983ana.8.2011.01.27.04.48.00 (version=SSLv3 cipher=RC4-MD5); Thu, 27 Jan 2011 04:48:00 -0800 (PST) From: Jeff Layton To: smfrench@gmail.com Cc: linux-cifs@vger.kernel.org Subject: [PATCH 2/2] cifs: don't always drop malformed replies on the floor Date: Thu, 27 Jan 2011 07:47:56 -0500 Message-Id: <1296132476-21948-2-git-send-email-jlayton@redhat.com> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: <1296132476-21948-1-git-send-email-jlayton@redhat.com> References: <1296132476-21948-1-git-send-email-jlayton@redhat.com> Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Thu, 27 Jan 2011 12:48:06 +0000 (UTC) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 921b884..8034da1 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -652,7 +652,7 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param, #define MID_REQUEST_SUBMITTED 2 #define MID_RESPONSE_RECEIVED 4 #define MID_RETRY_NEEDED 8 /* session closed while this request out */ -#define MID_NO_RESP_NEEDED 0x10 +#define MID_RESPONSE_MALFORMED 0x10 /* Types of response buffer returned from SendReceive2 */ #define CIFS_NO_BUFFER 0 /* Response buffer not returned */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 12a3e04..3afb746 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -584,11 +584,21 @@ incomplete_rcv: total_read += 4; /* account for rfc1002 hdr */ dump_smb(smb_buffer, total_read); - if (checkSMB(smb_buffer, smb_buffer->Mid, total_read)) { - cifs_dump_mem("Bad SMB: ", smb_buffer, 48); + + /* did we read enough to get to the Mid? */ + if (total_read < (sizeof(struct smb_hdr) - 1)) { + cERROR(1, "Received packet too short to reach MID: " + "%u bytes\n", total_read); + cifs_dump_mem("Bad SMB: ", smb_buffer, total_read); continue; } + /* + * we received enough to get to the MID, now check to see + * if the rest of the header checks out. + */ + length = checkSMB(smb_buffer, smb_buffer->Mid, total_read); + mid_entry = NULL; server->lstrp = jiffies; @@ -634,7 +644,12 @@ incomplete_rcv: mid_entry->resp_buf = smb_buffer; mid_entry->largeBuf = isLargeBuf; multi_t2_fnd: - mid_entry->midState = MID_RESPONSE_RECEIVED; + if (length == 0) + mid_entry->midState = + MID_RESPONSE_RECEIVED; + else + mid_entry->midState = + MID_RESPONSE_MALFORMED; list_del_init(&mid_entry->qhead); mid_entry->callback(mid_entry); #ifdef CONFIG_CIFS_STATS2 @@ -655,6 +670,9 @@ multi_t2_fnd: else smallbuf = NULL; } + } else if (length != 0) { + /* response sanity checks failed */ + continue; } else if (!is_valid_oplock_break(smb_buffer, server) && !isMultiRsp) { cERROR(1, "No task to wake, unknown frame received! " diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 748b3b8..14312e0 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -453,6 +453,9 @@ sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) case MID_RETRY_NEEDED: rc = -EAGAIN; break; + case MID_RESPONSE_MALFORMED: + rc = -EIO; + break; default: cERROR(1, "%s: invalid mid state mid=%d state=%d", __func__, mid->mid, mid->midState);