Bug 224359
| Summary: | CIFS: bad session setup packet alignment leads to kernel crash | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Steve Dickson <steved> | ||||
| Component: | kernel | Assignee: | Jeff Layton <jlayton> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Brian Brock <bbrock> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5.1 | CC: | bodenskiva, cnighswonger, dzickus, johnny, lars, rmonk, shirishp, staubach, steved | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | i686 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | RHBA-2007-0959 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2007-11-07 19:22:13 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 211672 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
|
Description
Steve Dickson
2007-01-25 13:06:47 UTC
Created attachment 146535 [details] Upstream patch Gitweb: http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8e6f195af0e1f226e9b2e0256af8df46adb9d595 Commit: 8e6f195af0e1f226e9b2e0256af8df46adb9d595 Parent: bd2abf177b3384375c43906be551d976e4c18166 Author: Steve French <sfrench.com> AuthorDate: Mon Jan 22 01:19:30 2007 +0000 Committer: Steve French <sfrench.com> CommitDate: Mon Jan 22 01:19:30 2007 +0000 [CIFS] Fix oops when Windows server sent bad domain name null terminator Fixes RedHat bug 211672 Windows sends one byte (instead of two) of null to terminate final Unicode string (domain name) in session setup response in some cases - this caused cifs to misalign some informational strings (making it hard to convert from UCS16 to UTF8). Thanks to Shaggy for his help and Akemi Yagi for debugging/testing Signed-off-by: Shirish Pargaonkar <shirishp.com> Signed-off-by: Steve French <sfrench.com> This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release. I'm looking at this case in the context of RHEL5, and I'll need to do a bit more explaining about why this patch should be included... Reading over the reports in the fedora BZ, it sounds pretty clearly like this patch fixed the problem. Is there a way to reproduce this? Alternately, is there an upstream discussion somewhere that describes how this bad session setup packet leads to the apparent list corruption that people were seeing? I'd like to understand how this patch corrects the panic people were seeing... While I still don't follow exactly how these panics follow from this issue, I think I understand the code well enough to propose it for inclusion into RHEL5. I've gone ahead and done that. This request was evaluated by Red Hat Kernel Team for inclusion in a Red Hat Enterprise Linux maintenance release, and has moved to bugzilla status POST. *** Bug 235296 has been marked as a duplicate of this bug. *** in 2.6.18-17.el5 An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-0959.html *** Bug 220806 has been marked as a duplicate of this bug. *** *** Bug 223328 has been marked as a duplicate of this bug. *** *** Bug 217914 has been marked as a duplicate of this bug. *** |