Skip to content

Commit

Permalink
cifs: always initialize struct msghdr smb_msg completely
Browse files Browse the repository at this point in the history
So far we were just lucky because the uninitialized members
of struct msghdr are not used by default on a SOCK_STREAM tcp
socket.

But as new things like msg_ubuf and sg_from_iter where added
recently, we should play on the safe side and avoid potention
problems in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
  • Loading branch information
Stefan Metzmacher authored and Steve French committed Sep 14, 2022
1 parent 17d3df3 commit bedc8f7
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 13 deletions.
11 changes: 3 additions & 8 deletions fs/cifs/connect.c
Original file line number Diff line number Diff line change
Expand Up @@ -702,9 +702,6 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
int length = 0;
int total_read;

smb_msg->msg_control = NULL;
smb_msg->msg_controllen = 0;

for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
try_to_freeze();

Expand Down Expand Up @@ -760,7 +757,7 @@ int
cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
unsigned int to_read)
{
struct msghdr smb_msg;
struct msghdr smb_msg = {};
struct kvec iov = {.iov_base = buf, .iov_len = to_read};
iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read);

Expand All @@ -770,15 +767,13 @@ cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
ssize_t
cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read)
{
struct msghdr smb_msg;
struct msghdr smb_msg = {};

/*
* iov_iter_discard already sets smb_msg.type and count and iov_offset
* and cifs_readv_from_socket sets msg_control and msg_controllen
* so little to initialize in struct msghdr
*/
smb_msg.msg_name = NULL;
smb_msg.msg_namelen = 0;
iov_iter_discard(&smb_msg.msg_iter, READ, to_read);

return cifs_readv_from_socket(server, &smb_msg);
Expand All @@ -788,7 +783,7 @@ int
cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page,
unsigned int page_offset, unsigned int to_read)
{
struct msghdr smb_msg;
struct msghdr smb_msg = {};
struct bio_vec bv = {
.bv_page = page, .bv_len = to_read, .bv_offset = page_offset};
iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read);
Expand Down
6 changes: 1 addition & 5 deletions fs/cifs/transport.c
Original file line number Diff line number Diff line change
Expand Up @@ -194,10 +194,6 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,

*sent = 0;

smb_msg->msg_name = NULL;
smb_msg->msg_namelen = 0;
smb_msg->msg_control = NULL;
smb_msg->msg_controllen = 0;
if (server->noblocksnd)
smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
else
Expand Down Expand Up @@ -309,7 +305,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
sigset_t mask, oldmask;
size_t total_len = 0, sent, size;
struct socket *ssocket = server->ssocket;
struct msghdr smb_msg;
struct msghdr smb_msg = {};
__be32 rfc1002_marker;

if (cifs_rdma_enabled(server)) {
Expand Down

0 comments on commit bedc8f7

Please sign in to comment.