Skip to contentSkip to conversation

cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

PATCH Applied Vasily Averin 2 participants 2 messages Jan 14, 2016 1 message not in the archive

Subsystems (2)
SMB client (CIFS) Kernel SMB3 server (ksmbd)
lore
Share & tools
lore

Vasily Averin

author
#0 lore raw

PATCH 1/1 cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized, therefore its printk with "%s" modifier can leak content of kernelspace memory. If old content of this buffer does not contain '\0' access bejond end of allocated object can crash the host.

Signed-off-by Vasily Averin <[email protected]>
---
 fs/cifs/readdir.c | 1 +
 1 file changed, 1 insertion(+)
fs/cifs/readdir.c +1 -0
index 0557c45..b30a4a6 100644
@@ -847,6 +847,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx)
 		 * if buggy server returns . and .. late do we want to
 		 * check for that here?
 		 */
+		*tmp_buf = 0;
 		rc = cifs_filldir(current_entry, file, ctx,
 				  tmp_buf, max_len);
 		if (rc) {
Signature · 1 line
1.9.1

A message that is not in the archive (sent off-list or not yet received): [email protected]

Applied
#2 lore raw

merged into cifs-2.6.git and added cc:stable

Let me know if other cifs/smb3 patches planned for 4.5

Quoted 29 lines · Vasily Averin

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized, therefore its printk with "%s" modifier can leak content of kernelspace memory. If old content of this buffer does not contain '\0' access bejond end of allocated object can crash the host.

Signed-off-by Vasily Averin <[email protected]>
---
 fs/cifs/readdir.c | 1 +
 1 file changed, 1 insertion(+)
fs/cifs/readdir.c +1 -1
index 0557c45..b30a4a6 100644
@@ -847,6 +847,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx)
                 * if buggy server returns . and .. late do we want to
                 * check for that here?
                 */
+               *tmp_buf = 0;
                rc = cifs_filldir(current_entry, file, ctx,
                                  tmp_buf, max_len);
                if (rc) {
--

1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Signature · 3 lines
Thanks,

Steve