git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 69765529d701c838df19ea1f5ad2f33a528261ae Mon Sep 17 00:00:00 2001
   2 From: Steve French <sfrench@us.ibm.com>
   3 Date: Tue, 17 Feb 2009 01:29:40 +0000
   4 Subject: [CIFS] Fix oops in cifs_strfromUCS_le mounting to servers which do not specify their OS
   5
   6 From: Steve French <sfrench@us.ibm.com>
   7
   8 commit 69765529d701c838df19ea1f5ad2f33a528261ae upstream.
   9
  10 Fixes kernel bug #10451 http://bugzilla.kernel.org/show_bug.cgi?id=10451
  11
  12 Certain NAS appliances do not set the operating system or network operating system
  13 fields in the session setup response on the wire.  cifs was oopsing on the unexpected
  14 zero length response fields (when trying to null terminate a zero length field).
  15
  16 This fixes the oops.
  17
  18 Acked-by: Jeff Layton <jlayton@redhat.com>
  19 Signed-off-by: Steve French <sfrench@us.ibm.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  21
  22 ---
  23  fs/cifs/CHANGES |    2 ++
  24  fs/cifs/sess.c  |    4 ++--
  25  2 files changed, 4 insertions(+), 2 deletions(-)
  26
  27 --- a/fs/cifs/CHANGES
  28 +++ b/fs/cifs/CHANGES
  29 @@ -1,3 +1,5 @@
  30 +Fix oops in cifs_dfs_ref.c when prefixpath is not reachable when using DFS.
  31 +
  32  Version 1.55
  33  ------------
  34  Various fixes to make delete of open files behavior more predictable
  35 --- a/fs/cifs/sess.c
  36 +++ b/fs/cifs/sess.c
  37 @@ -228,7 +228,7 @@ static int decode_unicode_ssetup(char **
  38
  39         kfree(ses->serverOS);
  40         /* UTF-8 string will not grow more than four times as big as UCS-16 */
  41 -       ses->serverOS = kzalloc(4 * len, GFP_KERNEL);
  42 +       ses->serverOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
  43         if (ses->serverOS != NULL)
  44                 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp);
  45         data += 2 * (len + 1);
  46 @@ -241,7 +241,7 @@ static int decode_unicode_ssetup(char **
  47                 return rc;
  48
  49         kfree(ses->serverNOS);
  50 -       ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */
  51 +       ses->serverNOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
  52         if (ses->serverNOS != NULL) {
  53                 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
  54                                    nls_cp);