mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 16:37:50 +00:00
cifs: sanitize multiple delimiters in prepath
commita31080899d
upstream. mount.cifs can pass a device with multiple delimiters in it. This will cause rename(2) to fail with ENOENT. V2: - Make sanitize_path more readable. - Fix multiple delimiters between UNC and prepath. - Avoid a memory leak if a bad user starts putting a lot of delimiters in the path on purpose. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2031200 Fixes:24e0a1eff9
("cifs: switch to new mount api") Cc: stable@vger.kernel.org # 5.11+ Acked-by: Ronnie Sahlberg <lsahlber@redhat.com> Signed-off-by: Thiago Rafael Becker <trbecker@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c5664d5086
commit
c63433a09d
1 changed files with 37 additions and 1 deletions
|
@ -431,6 +431,42 @@ int smb3_parse_opt(const char *options, const char *key, char **val)
|
|||
return rc;
|
||||
}
|
||||
|
||||
/*
|
||||
* Remove duplicate path delimiters. Windows is supposed to do that
|
||||
* but there are some bugs that prevent rename from working if there are
|
||||
* multiple delimiters.
|
||||
*
|
||||
* Returns a sanitized duplicate of @path. The caller is responsible for
|
||||
* cleaning up the original.
|
||||
*/
|
||||
#define IS_DELIM(c) ((c) == '/' || (c) == '\\')
|
||||
static char *sanitize_path(char *path)
|
||||
{
|
||||
char *cursor1 = path, *cursor2 = path;
|
||||
|
||||
/* skip all prepended delimiters */
|
||||
while (IS_DELIM(*cursor1))
|
||||
cursor1++;
|
||||
|
||||
/* copy the first letter */
|
||||
*cursor2 = *cursor1;
|
||||
|
||||
/* copy the remainder... */
|
||||
while (*(cursor1++)) {
|
||||
/* ... skipping all duplicated delimiters */
|
||||
if (IS_DELIM(*cursor1) && IS_DELIM(*cursor2))
|
||||
continue;
|
||||
*(++cursor2) = *cursor1;
|
||||
}
|
||||
|
||||
/* if the last character is a delimiter, skip it */
|
||||
if (IS_DELIM(*(cursor2 - 1)))
|
||||
cursor2--;
|
||||
|
||||
*(cursor2) = '\0';
|
||||
return kstrdup(path, GFP_KERNEL);
|
||||
}
|
||||
|
||||
/*
|
||||
* Parse a devname into substrings and populate the ctx->UNC and ctx->prepath
|
||||
* fields with the result. Returns 0 on success and an error otherwise
|
||||
|
@ -490,7 +526,7 @@ smb3_parse_devname(const char *devname, struct smb3_fs_context *ctx)
|
|||
if (!*pos)
|
||||
return 0;
|
||||
|
||||
ctx->prepath = kstrdup(pos, GFP_KERNEL);
|
||||
ctx->prepath = sanitize_path(pos);
|
||||
if (!ctx->prepath)
|
||||
return -ENOMEM;
|
||||
|
||||
|
|
Loading…
Reference in a new issue