lkml.org 
[lkml]   [2012]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[v2.6.34-stable 010/165] cifs: fix possible memory corruption in CIFSFindNext
    Date
    From: Jeff Layton <jlayton@redhat.com>

    -------------------
    This is a commit scheduled for the next v2.6.34 longterm release.
    http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
    If you see a problem with using this for longterm, please comment.
    -------------------

    commit 9438fabb73eb48055b58b89fc51e0bc4db22fabd upstream.

    The name_len variable in CIFSFindNext is a signed int that gets set to
    the resume_name_len in the cifs_search_info. The resume_name_len however
    is unsigned and for some infolevels is populated directly from a 32 bit
    value sent by the server.

    If the server sends a very large value for this, then that value could
    look negative when converted to a signed int. That would make that
    value pass the PATH_MAX check later in CIFSFindNext. The name_len would
    then be used as a length value for a memcpy. It would then be treated
    as unsigned again, and the memcpy scribbles over a ton of memory.

    Fix this by making the name_len an unsigned value in CIFSFindNext.

    Reported-by: Darren Lavender <dcl@hppine99.gbr.hp.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    fs/cifs/cifssmb.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
    index 62e49ab..5171d86 100644
    --- a/fs/cifs/cifssmb.c
    +++ b/fs/cifs/cifssmb.c
    @@ -3743,7 +3743,8 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
    T2_FNEXT_RSP_PARMS *parms;
    char *response_data;
    int rc = 0;
    - int bytes_returned, name_len;
    + int bytes_returned;
    + unsigned int name_len;
    __u16 params, byte_count;

    cFYI(1, ("In FindNext"));
    --
    1.7.12.rc2


    \
     
     \ /
      Last update: 2012-08-15 23:23    [W:2.716 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site