oss-security - Re: CVE request - kernel: cifs: Fix a kernel BUG with remote OS/2 server

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1208294075.1380471277756617586.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 28 Jun 2010 16:23:37 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: cifs: Fix a kernel BUG
 with remote OS/2 server

Please use CVE-2010-2248

Thanks.

-- 
    JB


----- "Eugene Teo" <eugeneteo@...nel.sg> wrote:

> "This was known to trigger with a OS/2 server. The server sets 
> pSMBr->CountHigh to a incorrect value even in case of normal writes. 
> This results in 'nbytes' being computed wrongly and triggers a kernel
> 
> BUG at mm/filemap.c.
> 
>      void iov_iter_advance(struct iov_iter *i, size_t bytes)
>      {
>              BUG_ON(i->count < bytes);    <--- BUG here
> 
> Why the server is setting 'CountHigh' is not clear but only does so 
> after writing 64k bytes. Though this looks like the server bug, the 
> client side crash may not be acceptable.
> 
> The workaround is to mask off high 16 bits if the number of bytes 
> written as returned by the server is greater than the bytes requested
> by 
> the client."
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=608583
> http://git.kernel.org/linus/6513a81e9325d712f1bfb9a1d7b750134e49ff18
> 
> -- 
> main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i);
> }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.