The Samba-Bugzilla – Attachment 11569 Details for
Bug 11581
Samba segfaults because of a use after free in the smb2 server
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Patches for v4-3-test
tmp43.diff.txt (text/plain), 3.33 KB, created by
Stefan Metzmacher
on 2015-11-03 08:47:11 UTC
(
hide
)
Description:
Patches for v4-3-test
Filename:
MIME Type:
Creator:
Stefan Metzmacher
Created:
2015-11-03 08:47:11 UTC
Size:
3.33 KB
patch
obsolete
>From 3da7e6a079e4f52ffd6eb0bd403759f1f642ccab Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Fri, 30 Oct 2015 09:01:28 +0100 >Subject: [PATCH 1/2] s3-smbd: Fix use after issue in > smbd_smb2_request_dispatch() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11581 > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> > >Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> >Autobuild-Date(master): Fri Oct 30 19:49:47 CET 2015 on sn-devel-104 > >(cherry picked from commit db9e10d071793b91b3f3d40225a8634e3c34f65e) >--- > source3/smbd/smb2_server.c | 15 ++++++++------- > 1 file changed, 8 insertions(+), 7 deletions(-) > >diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c >index 40f3f2d..0ae3fc8 100644 >--- a/source3/smbd/smb2_server.c >+++ b/source3/smbd/smb2_server.c >@@ -1703,13 +1703,6 @@ static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req) > search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID); > search_async_id = BVAL(inhdr, SMB2_HDR_PID); > >- /* >- * we don't need the request anymore >- * cancel requests never have a response >- */ >- DLIST_REMOVE(xconn->smb2.requests, req); >- TALLOC_FREE(req); >- > for (cur = xconn->smb2.requests; cur; cur = cur->next) { > const uint8_t *outhdr; > uint64_t message_id; >@@ -2350,6 +2343,14 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) > req->profile, _INBYTES(req)); > return_value = smbd_smb2_request_process_cancel(req); > SMBPROFILE_IOBYTES_ASYNC_END(req->profile, 0); >+ >+ /* >+ * We don't need the request anymore cancel requests never >+ * have a response. >+ */ >+ DLIST_REMOVE(xconn->smb2.requests, req); >+ TALLOC_FREE(req); >+ > break; > > case SMB2_OP_KEEPALIVE: >-- >1.9.1 > > >From dac60380b15fb457b608ffa4f247dc35dd095cae Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Mon, 2 Nov 2015 13:40:24 +0100 >Subject: [PATCH 2/2] s3:smb2_server: make the logic of SMB2_CANCEL > DLIST_REMOVE() clearer > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=11581 > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> >(cherry picked from commit ad85c8905184d125a2a38569f7955ccbf443ebcd) >--- > source3/smbd/smb2_server.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > >diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c >index 0ae3fc8..09633a3 100644 >--- a/source3/smbd/smb2_server.c >+++ b/source3/smbd/smb2_server.c >@@ -1703,6 +1703,14 @@ static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req) > search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID); > search_async_id = BVAL(inhdr, SMB2_HDR_PID); > >+ /* >+ * We don't need the request anymore cancel requests never >+ * have a response. >+ * >+ * We defer the TALLOC_FREE(req) to the caller. >+ */ >+ DLIST_REMOVE(xconn->smb2.requests, req); >+ > for (cur = xconn->smb2.requests; cur; cur = cur->next) { > const uint8_t *outhdr; > uint64_t message_id; >@@ -2347,8 +2355,10 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) > /* > * We don't need the request anymore cancel requests never > * have a response. >+ * >+ * smbd_smb2_request_process_cancel() already called >+ * DLIST_REMOVE(xconn->smb2.requests, req); > */ >- DLIST_REMOVE(xconn->smb2.requests, req); > TALLOC_FREE(req); > > break; >-- >1.9.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
slow
:
review+
jra
:
review+
Actions:
View
Attachments on
bug 11581
:
11566
| 11569