Commit 331c3135 authored Dec 17, 2008 by Jeff Layton Committed by Linus Torvalds Dec 17, 2008

cifs: fix buffer overrun in parse_DFS_referrals



While testing a kernel with memory poisoning enabled, I saw some warnings
about the redzone getting clobbered when chasing DFS referrals. The
buffer allocation for the unicode converted version of the searchName is
too small and needs to take null termination into account.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent a52519f2

fs/cifs/cifssmb.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -3983,7 +3983,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,

		node->flags = le16_to_cpu(pSMBr->DFSFlags);
		if (is_unicode) {
		__le16 tmp = kmalloc(strlen(searchName)2, GFP_KERNEL);
		__le16 tmp = kmalloc(strlen(searchName)2 + 2,
		GFP_KERNEL);
		cifsConvertToUCS((__le16 *) tmp, searchName,
		PATH_MAX, nls_codepage, remap);
		node->path_consumed = hostlen_fromUCS(tmp,

Admin message