• Jeff Layton's avatar
    cifs: force a reconnect if there are too many MIDs in flight · 92a4e0f0
    Jeff Layton authored
    Currently, we allow the pending_mid_q to grow without bound with
    SIGKILL'ed processes. This could eventually be a DoS'able problem. An
    unprivileged user could a process that does a long-running call and then
    SIGKILL it.
    
    If he can also intercept the NT_CANCEL calls or the replies from the
    server, then the pending_mid_q could grow very large, possibly even to
    2^16 entries which might leave GetNextMid in an infinite loop. Fix this
    by imposing a hard limit of 32k calls per server. If we cross that
    limit, set the tcpStatus to CifsNeedReconnect to force cifsd to
    eventually reconnect the socket and clean out the pending_mid_q.
    
    While we're at it, clean up the function a bit and eliminate an
    unnecessary NULL pointer check.
    Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
    Reviewed-by: default avatarShirish Pargaonkar <shirishpargaonkar@gmail.com>
    Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
    92a4e0f0
misc.c 20.6 KB