cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
authorVasily Averin <vvs@virtuozzo.com>
Thu, 14 Jan 2016 10:41:14 +0000 (13:41 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Feb 2016 20:01:17 +0000 (12:01 -0800)
commit7e30995b26ccc952e30bbc2563fc5728c50c9e12
treeeb565764a44574481c06deffc8ac3979b7d7f5bf
parent5d80673404e691093d66fc5b02c8bc2ac1692d77
cifs_dbg() outputs an uninitialized buffer in cifs_readdir()

commit 01b9b0b28626db4a47d7f48744d70abca9914ef1 upstream.

In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized,
therefore its printk with "%s" modifier can leak content of kernelspace memory.
If old content of this buffer does not contain '\0' access bejond end of
allocated object can crash the host.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steve French <sfrench@localhost.localdomain>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/cifs/readdir.c