cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
authorVasily Averin <vvs@virtuozzo.com>
Thu, 14 Jan 2016 10:41:14 +0000 (13:41 +0300)
committerSasha Levin <sasha.levin@oracle.com>
Wed, 3 Feb 2016 21:23:16 +0000 (16:23 -0500)
commitc5882812d2e1ab7db5bc71a1bca90b3a2d89dedd
tree996a4e80899dedd66197aff35e2a6d6add7966f4
parent99b79b15df4ed1a6293cff487b46efc86bd20ae5
cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

[ Upstream commit 01b9b0b28626db4a47d7f48744d70abca9914ef1 ]

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized,
therefore its printk with "%s" modifier can leak content of kernelspace memory.
If old content of this buffer does not contain '\0' access bejond end of
allocated object can crash the host.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steve French <sfrench@localhost.localdomain>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
fs/cifs/readdir.c