Messages in this thread Patch in this message | | | Date | Wed, 29 Apr 2009 15:07:06 -0700 | From | Greg KH <> | Subject | [patch 07/58] CIFS: Fix memory overwrite when saving nativeFileSystem field during mount |
| |
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Steve French <sfrench@us.ibm.com>
upstream commit: b363b3304bcf68c4541683b2eff70b29f0446a5b
CIFS can allocate a few bytes to little for the nativeFileSystem field during tree connect response processing during mount. This can result in a "Redzone overwritten" message to be logged.
Signed-off-by: Sridhar Vinay <vinaysridhar@in.ibm.com> Acked-by: Shirish Pargaonkar <shirishp@us.ibm.com> CC: Stable <stable@kernel.org> Signed-off-by: Steve French <sfrench@us.ibm.com> [chrisw: minor backport to CHANGES file] Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/cifs/CHANGES | 3 +++ fs/cifs/connect.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
--- a/fs/cifs/CHANGES +++ b/fs/cifs/CHANGES @@ -1,4 +1,7 @@ Fix oops in cifs_dfs_ref.c when prefixpath is not reachable when using DFS. +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too +little memory for the "nativeFileSystem" field returned by the server +during mount). Version 1.54 ------------ --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3549,7 +3549,7 @@ CIFSTCon(unsigned int xid, struct cifsSe BCC(smb_buffer_response)) { kfree(tcon->nativeFileSystem); tcon->nativeFileSystem = - kzalloc(length + 2, GFP_KERNEL); + kzalloc(2*(length + 1), GFP_KERNEL); if (tcon->nativeFileSystem) cifs_strfromUCS_le( tcon->nativeFileSystem,
| |