From b363b3304bcf68c4541683b2eff70b29f0446a5b Mon Sep 17 00:00:00 2001 From: Steve French Date: Wed, 18 Mar 2009 05:57:22 +0000 Subject: [CIFS] Fix memory overwrite when saving nativeFileSystem field during mount CIFS can allocate a few bytes to little for the nativeFileSystem field during tree connect response processing during mount. This can result in a "Redzone overwritten" message to be logged. Signed-off-by: Sridhar Vinay Acked-by: Shirish Pargaonkar CC: Stable Signed-off-by: Steve French --- fs/cifs/CHANGES | 3 +++ fs/cifs/connect.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) (limited to 'fs') diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES index fc977dfe959..65984006192 100644 --- a/fs/cifs/CHANGES +++ b/fs/cifs/CHANGES @@ -13,6 +13,9 @@ parameter to allow user to disable sending the (slow) SMB flush on fsync if desired (fsync still flushes all cached write data to the server). Posix file open support added (turned off after one attempt if server fails to support it properly, as with Samba server versions prior to 3.3.2) +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too +little memory for the "nativeFileSystem" field returned by the server +during mount). Version 1.56 ------------ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index cd4ccc8ce47..0de3b5615a2 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3674,7 +3674,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses, BCC(smb_buffer_response)) { kfree(tcon->nativeFileSystem); tcon->nativeFileSystem = - kzalloc(length + 2, GFP_KERNEL); + kzalloc(2*(length + 1), GFP_KERNEL); if (tcon->nativeFileSystem) cifs_strfromUCS_le( tcon->nativeFileSystem, -- cgit v1.2.3