cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

Browse source

[ Upstream commit 01b9b0b286 ]

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized,
therefore its printk with "%s" modifier can leak content of kernelspace memory.
If old content of this buffer does not contain '\0' access bejond end of
allocated object can crash the host.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steve French <sfrench@localhost.localdomain>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

...

This commit is contained in:

Vasily Averin 2016-01-14 13:41:14 +03:00 • committed by Sasha Levin

parent 99b79b15df

commit c5882812d2

1 changed files with 1 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

fs/cifs/readdir.c

View file