p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

CIFS: Fix possible buffer corruption in cifs_user_read() 

If there was a short read in the middle of the rdata list,
we can end up with a corrupt output buffer.

Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
This commit is contained in:
Pavel Shilovsky 2014-07-10 10:21:15 +04:00 committed by Steve French
parent b3160aebb4
commit 2e8a05d802
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/cifs/file.c
View File

@ -3049,7 +3049,9 @@ ssize_t cifs_user_readv(struct kiocb *iocb, struct iov_iter *to)
} else {
rc = cifs_readdata_to_iov(rdata, to);
}
/* if there was a short read -- discard anything left */
if (rdata->got_bytes && rdata->got_bytes < rdata->bytes)
rc = -ENODATA;
}
list_del_init(&rdata->list);
kref_put(&rdata->refcount, cifs_uncached_readdata_release);