From: Jann Horn <jann@thejh.net>
Date: Fri, 11 Sep 2015 14:27:27 +0000 (+0200)
Subject: CIFS: fix type confusion in copy offload ioctl
X-Git-Tag: omap-for-v4.3/fixes-rc5~137^2~1
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c17a6d56bb0cad3066a714e94f7185a24b40f49;p=pandora-kernel.git

CIFS: fix type confusion in copy offload ioctl

This might lead to local privilege escalation (code execution as
kernel) for systems where the following conditions are met:

 - CONFIG_CIFS_SMB2 and CONFIG_CIFS_POSIX are enabled
 - a cifs filesystem is mounted where:
  - the mount option "vers" was used and set to a value >=2.0
  - the attacker has write access to at least one file on the filesystem

To attack this, an attacker would have to guess the target_tcon
pointer (but guessing wrong doesn't cause a crash, it just returns an
error code) and win a narrow race.

CC: Stable <stable@vger.kernel.org>
Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Steve French <smfrench@gmail.com>
---

Reading git-diff-tree failed