[PATCH 0/6] cifs: add some bounds checking to xattr parsing routines (try #3)

This is the third iteration of the patchset to add bounds checking to
CIFSSMBQAllEAs. The main difference in this patchset is that it merges
the CIFSSMBQueryEA call with CIFSSMBQAllEAs. That function needed proper
bounds checking too. In looking at it, I determined that there was a lot
of overlap between those functions, so it makes sense to share some code
here.

We had a customer recently report an oops in CIFSSMBQAllEAs. The details
were a little sketchy, but after looking at the oops and the code, I
think the problem was that the QUERY_ALL_EAS response from the server
was malformed and that caused the parser to walk off of the end of the
SMB response.

This patchset is an attempt to prevent that from happening again. The
idea here is to ensure that the total length of the list in the
QUERY_ALL_EAS response don't go beyond the end of the SMB (as determined
by the ByteCount), and that the lengths of the individual fields in each
entry don't go beyond the end of the list.

I forsee this set as a candidate for 2.6.34. Comments and suggestions
appreciated...

Jeff Layton (6):
  cifs: add parens around smb_var in BCC macros
  cifs: clean up indentation in CIFSSMBQAllEAs
  cifs: rename name_len to list_len in CIFSSMBQAllEAs
  cifs: increase maximum buffer size in CIFSSMBQAllEAs
  cifs: verify lengths of QueryAllEAs reply
  cifs: merge CIFSSMBQueryEA with CIFSSMBQAllEAs

 fs/cifs/cifspdu.h   |    6 +-
 fs/cifs/cifsproto.h |    7 +-
 fs/cifs/cifssmb.c   |  348 ++++++++++++++++++---------------------------------
 fs/cifs/inode.c     |    2 +-
 fs/cifs/xattr.c     |    8 +-
 5 files changed, 130 insertions(+), 241 deletions(-)