diff options
| author | Pavel Shilovsky | 2014-07-10 08:21:15 +0200 |
|---|---|---|
| committer | Steve French | 2014-08-02 08:23:04 +0200 |
| commit | 2e8a05d80213cdfbf3bf8e6eb3059831c7015e89 (patch) | |
| tree | 571a362d0bb4af0d8e2a7e60b9082d906221b329 /fs/cifs/file.c | |
| parent | CIFS: Count got bytes in read_into_pages() (diff) | |
| download | kernel-qcow2-linux-2e8a05d80213cdfbf3bf8e6eb3059831c7015e89.tar.gz kernel-qcow2-linux-2e8a05d80213cdfbf3bf8e6eb3059831c7015e89.tar.xz kernel-qcow2-linux-2e8a05d80213cdfbf3bf8e6eb3059831c7015e89.zip | |
CIFS: Fix possible buffer corruption in cifs_user_read()
If there was a short read in the middle of the rdata list,
we can end up with a corrupt output buffer.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Diffstat (limited to 'fs/cifs/file.c')
| -rw-r--r-- | fs/cifs/file.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 3ea6fc86a471..c3390e2c6e0d 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -3049,7 +3049,9 @@ again: } else { rc = cifs_readdata_to_iov(rdata, to); } - + /* if there was a short read -- discard anything left */ + if (rdata->got_bytes && rdata->got_bytes < rdata->bytes) + rc = -ENODATA; } list_del_init(&rdata->list); kref_put(&rdata->refcount, cifs_uncached_readdata_release); |