cifsd: Update out_buf_len in smb2_populate_readdir_entry()
authorMarios Makassikis <mmakassikis@freebox.fr>
Thu, 6 May 2021 02:40:02 +0000 (11:40 +0900)
committerSteve French <stfrench@microsoft.com>
Tue, 11 May 2021 00:15:47 +0000 (19:15 -0500)
commite7735c854880084a6d97e60465f19daa42842eff
treee2978eab92d876060095a65ab514191173749603
parent79caa9606df1504b3b5104457cbb5d759f0e5fae
cifsd: Update out_buf_len in smb2_populate_readdir_entry()

When processing a SMB2 QUERY_DIRECTORY request,
smb2_populate_readdir_entry() is called first to fill the dot/dotdot
entries. This moves the d_info->wptr pointer but out_buf_len remains
unchanged. As a result, reserve_populate_dentry() may end up writing
past the end of the buffer since the bounds checking is done on
invalid values.

Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/cifsd/smb2pdu.c