Commit 331c3135 authored by Jeff Layton's avatar Jeff Layton Committed by Linus Torvalds

cifs: fix buffer overrun in parse_DFS_referrals

While testing a kernel with memory poisoning enabled, I saw some warnings
about the redzone getting clobbered when chasing DFS referrals. The
buffer allocation for the unicode converted version of the searchName is
too small and needs to take null termination into account.
Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Acked-by: default avatarSteve French <sfrench@us.ibm.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent a52519f2
...@@ -3983,7 +3983,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr, ...@@ -3983,7 +3983,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
node->flags = le16_to_cpu(pSMBr->DFSFlags); node->flags = le16_to_cpu(pSMBr->DFSFlags);
if (is_unicode) { if (is_unicode) {
__le16 *tmp = kmalloc(strlen(searchName)*2, GFP_KERNEL); __le16 *tmp = kmalloc(strlen(searchName)*2 + 2,
GFP_KERNEL);
cifsConvertToUCS((__le16 *) tmp, searchName, cifsConvertToUCS((__le16 *) tmp, searchName,
PATH_MAX, nls_codepage, remap); PATH_MAX, nls_codepage, remap);
node->path_consumed = hostlen_fromUCS(tmp, node->path_consumed = hostlen_fromUCS(tmp,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment