]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commit
cifs: fix out-of-bound memory access when calling smb3_notify() at mount point
authorEugene Korenevsky <ekorenevsky@astralinux.ru>
Fri, 16 Apr 2021 07:35:30 +0000 (10:35 +0300)
committerStefan Bader <stefan.bader@canonical.com>
Wed, 19 May 2021 08:31:55 +0000 (10:31 +0200)
commit18fa27e15793695c51edc4006bad075e4e0fb6d4
tree1d31f05aea01f187edaf1a167280341dffee97c4
parent11f3aa22a818001d02905d6dd41e54a5a8962b92
cifs: fix out-of-bound memory access when calling smb3_notify() at mount point

BugLink: https://bugs.launchpad.net/bugs/1928857
commit a637f4ae037e1e0604ac008564934d63261a8fd1 upstream.

If smb3_notify() is called at mount point of CIFS, build_path_from_dentry()
returns the pointer to kmalloc-ed memory with terminating zero (this is
empty FileName to be passed to SMB2 CREATE request). This pointer is assigned
to the `path` variable.
Then `path + 1` (to skip first backslash symbol) is passed to
cifs_convert_path_to_utf16(). This is incorrect for empty path and causes
out-of-bound memory access.

Get rid of this "increase by one". cifs_convert_path_to_utf16() already
contains the check for leading backslash in the path.

BugzillaLink: https://bugzilla.kernel.org/show_bug.cgi?id=212693
CC: <stable@vger.kernel.org> # v5.6+
Signed-off-by: Eugene Korenevsky <ekorenevsky@astralinux.ru>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
fs/cifs/smb2ops.c