From 4acbb3fbaccda1f1d38e7154228e052ce80a2dfa Mon Sep 17 00:00:00 2001 From: Olaf Kirch Date: Wed, 3 May 2006 21:30:11 -0700 Subject: [PATCH] smbfs chroot issue (CVE-2006-1864) Mark Moseley reported that a chroot environment on a SMB share can be left via "cd ..\\". Similar to CVE-2006-1863 issue with cifs, this fix is for smbfs. Steven French wrote: Looks fine to me. This should catch the slash on lookup or equivalent, which will be all obvious paths of interest. Signed-off-by: Chris Wright --- fs/smbfs/dir.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'fs/smbfs') diff --git a/fs/smbfs/dir.c b/fs/smbfs/dir.c index 0424d06b147e..45862eca8456 100644 --- a/fs/smbfs/dir.c +++ b/fs/smbfs/dir.c @@ -434,6 +434,11 @@ smb_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd) if (dentry->d_name.len > SMB_MAXNAMELEN) goto out; + /* Do not allow lookup of names with backslashes in */ + error = -EINVAL; + if (memchr(dentry->d_name.name, '\\', dentry->d_name.len)) + goto out; + lock_kernel(); error = smb_proc_getattr(dentry, &finfo); #ifdef SMBFS_PARANOIA -- cgit v1.2.3