From: Steve French Date: Thu, 26 Mar 2009 23:05:15 +0000 (+0000) Subject: CIFS: Fix memory overwrite when saving nativeFileSystem field during mount X-Git-Tag: v2.6.27.22~52 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=080be8b26ef33af424efb9a64c95cd7766cdc114;p=thirdparty%2Fkernel%2Fstable.git CIFS: Fix memory overwrite when saving nativeFileSystem field during mount upstream commit: b363b3304bcf68c4541683b2eff70b29f0446a5b CIFS can allocate a few bytes to little for the nativeFileSystem field during tree connect response processing during mount. This can result in a "Redzone overwritten" message to be logged. Signed-off-by: Sridhar Vinay Acked-by: Shirish Pargaonkar CC: Stable Signed-off-by: Steve French [chrisw: minor backport to CHANGES file] Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES index 088e9ae5c58d4..455257e71e002 100644 --- a/fs/cifs/CHANGES +++ b/fs/cifs/CHANGES @@ -1,4 +1,7 @@ Fix oops in cifs_dfs_ref.c when prefixpath is not reachable when using DFS. +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too +little memory for the "nativeFileSystem" field returned by the server +during mount). Version 1.54 ------------ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index f254235814a85..21a1abfbb447f 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3549,7 +3549,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses, BCC(smb_buffer_response)) { kfree(tcon->nativeFileSystem); tcon->nativeFileSystem = - kzalloc(length + 2, GFP_KERNEL); + kzalloc(2*(length + 1), GFP_KERNEL); if (tcon->nativeFileSystem) cifs_strfromUCS_le( tcon->nativeFileSystem,