Re: [2.6 patch] fs/smbfs/request.c: turn NULL dereference intoBUG()

[Jean Delvare]

Hi Adrian,

> On Sat, Mar 26, 2005 at 01:53:01PM +0100, Adrian Bunk wrote:
> >...
> > The problem is actually only in the SMB_RECV_END and
> > SMB_RECV_REQUEST  cases and all code after the NULL pointer
> > dereference is actually dead  code.
> >...
> 
> OK, this was also wrong...

I can confirm, I gave it a try and had to reboot ;)

You are right that the problem is only in the SMB_RECV_END and
SMB_RECV_REQUEST cases. I had missed that point in the patch I proposed.

> Third try.
> (...)
> In a case documented as
>   We should never be called with any of these states
> BUG() in a case that would later result in a NULL pointer dereference.
> (...)
> --- linux-2.6.12-rc1-mm3-full/fs/smbfs/request.c.old	2005-03-26 13:19:19.000000000 +0100
> +++ linux-2.6.12-rc1-mm3-full/fs/smbfs/request.c	2005-03-26 13:41:30.000000000 +0100
> @@ -786,8 +642,7 @@ int smb_request_recv(struct smb_sb_info 
>  		/* We should never be called with any of these states */
>  	case SMB_RECV_END:
>  	case SMB_RECV_REQUEST:
> -		server->rstate = SMB_RECV_END;
> -		break;
> +		BUG();
>  	}

Yes, after reading the whole thing again, it seems to be the correct
thing to do, providing that "should never" is a reference to an internal
state and not something from the outside. I don't know myself, but you
seem to do. Maybe someone from the samba team could confirm?

BTW, it looks to me like Urban Widmark, the author of this module and
supposedly the maintainer of it as well, has vanished some times ago.
Last seen 2004-06-21, and no working e-mail address (both failes for
me). Shouldn't we mark smbfs as unmaintained in MAINTAINERS, or have
someone else take over? Any volunteer?

Thanks,
-- 
Jean Delvare
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/