From: Steve French Date: Thu, 26 Mar 2009 23:05:15 +0000 (+0000) Subject: CIFS: Fix memory overwrite when saving nativeFileSystem field during mount X-Git-Tag: v2.6.28.10~73 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fd460577ce2d8a027154afacebb6c00d556bde17;p=thirdparty%2Fkernel%2Fstable.git CIFS: Fix memory overwrite when saving nativeFileSystem field during mount upstream commit: b363b3304bcf68c4541683b2eff70b29f0446a5b CIFS can allocate a few bytes to little for the nativeFileSystem field during tree connect response processing during mount. This can result in a "Redzone overwritten" message to be logged. Signed-off-by: Sridhar Vinay Acked-by: Shirish Pargaonkar Signed-off-by: Steve French [chrisw: minor backport to CHANGES file] Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES index 4c1cb9a5523e6..3c8b48df69615 100644 --- a/fs/cifs/CHANGES +++ b/fs/cifs/CHANGES @@ -1,4 +1,7 @@ Fix oops in cifs_dfs_ref.c when prefixpath is not reachable when using DFS. +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too +little memory for the "nativeFileSystem" field returned by the server +during mount). Version 1.55 ------------ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index b5b8649bd8edc..6c71d4b517d4d 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3565,7 +3565,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses, BCC(smb_buffer_response)) { kfree(tcon->nativeFileSystem); tcon->nativeFileSystem = - kzalloc(length + 2, GFP_KERNEL); + kzalloc(2*(length + 1), GFP_KERNEL); if (tcon->nativeFileSystem) cifs_strfromUCS_le( tcon->nativeFileSystem,