]> www.infradead.org Git - users/jedix/linux-maple.git/commit
cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
authorVasily Averin <vvs@virtuozzo.com>
Thu, 14 Jan 2016 10:41:14 +0000 (13:41 +0300)
committerChuck Anderson <chuck.anderson@oracle.com>
Thu, 26 May 2016 22:44:15 +0000 (15:44 -0700)
commit927d6d5ab153eb9f72a2d82c7f497d52532a87d4
treefff31e94249925c2c185ac51cadd51bd4801eb29
parent5fc4796919f9ceac4a82663c9fb46bfdcb7bf9bb
cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

Orabug: 23330633

[ Upstream commit 01b9b0b28626db4a47d7f48744d70abca9914ef1 ]

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized,
therefore its printk with "%s" modifier can leak content of kernelspace memory.
If old content of this buffer does not contain '\0' access bejond end of
allocated object can crash the host.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steve French <sfrench@localhost.localdomain>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit c5882812d2e1ab7db5bc71a1bca90b3a2d89dedd)

Signed-off-by: Dan Duval <dan.duval@oracle.com>
fs/cifs/readdir.c