cifs: make sure we allocate enough storage for socket address

The sockaddr declared on the stack in cifs_get_tcp_session is too small
for IPv6 addresses. Change it from "struct sockaddr" to "struct
sockaddr_storage" to prevent stack corruption when IPv6 is used.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index a3537a90a9d97f63ca87ffb69d74aec4199db337..2209be94305132f375b1082193bdcf7280c312d8 100644 (file)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1354,7 +1354,7 @@ cifs_parse_mount_options(char *options, const char *devname,
 }
 
 static struct TCP_Server_Info *
-cifs_find_tcp_session(struct sockaddr *addr)
+cifs_find_tcp_session(struct sockaddr_storage *addr)
 {
        struct list_head *tmp;
        struct TCP_Server_Info *server;
@@ -1374,11 +1374,11 @@ cifs_find_tcp_session(struct sockaddr *addr)
                if (server->tcpStatus == CifsNew)
                        continue;
 
-               if (addr->sa_family == AF_INET &&
+               if (addr->ss_family == AF_INET &&
                    (addr4->sin_addr.s_addr !=
                     server->addr.sockAddr.sin_addr.s_addr))
                        continue;
-               else if (addr->sa_family == AF_INET6 &&
+               else if (addr->ss_family == AF_INET6 &&
                         memcmp(&server->addr.sockAddr6.sin6_addr,
                                &addr6->sin6_addr, sizeof(addr6->sin6_addr)))
                        continue;
@@ -1419,12 +1419,12 @@ static struct TCP_Server_Info *
 cifs_get_tcp_session(struct smb_vol *volume_info)
 {
        struct TCP_Server_Info *tcp_ses = NULL;
-       struct sockaddr addr;
+       struct sockaddr_storage addr;
        struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
        struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
        int rc;
 
-       memset(&addr, 0, sizeof(struct sockaddr));
+       memset(&addr, 0, sizeof(struct sockaddr_storage));
 
        if (volume_info->UNCip && volume_info->UNC) {
                rc = cifs_inet_pton(AF_INET, volume_info->UNCip,
@@ -1435,9 +1435,9 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                        rc = cifs_inet_pton(AF_INET6, volume_info->UNCip,
                                            &sin_server6->sin6_addr.in6_u);
                        if (rc > 0)
-                               addr.sa_family = AF_INET6;
+                               addr.ss_family = AF_INET6;
                } else {
-                       addr.sa_family = AF_INET;
+                       addr.ss_family = AF_INET;
                }
 
                if (rc <= 0) {
@@ -1502,7 +1502,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
        tcp_ses->tcpStatus = CifsNew;
        ++tcp_ses->srv_count;
 
-       if (addr.sa_family == AF_INET6) {
+       if (addr.ss_family == AF_INET6) {
                cFYI(1, ("attempting ipv6 connect"));
                /* BB should we allow ipv6 on port 139? */
                /* other OS never observed in Wild doing 139 with v6 */