cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

Browse source

commit 01b9b0b286 upstream.

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized,
therefore its printk with "%s" modifier can leak content of kernelspace memory.
If old content of this buffer does not contain '\0' access bejond end of
allocated object can crash the host.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steve French <sfrench@localhost.localdomain>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Vasily Averin 2016-01-14 13:41:14 +03:00 • committed by Greg Kroah-Hartman

parent 5d80673404

commit 7e30995b26

1 changed files with 1 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

fs/cifs/readdir.c

View file