From patchwork Thu Jul 10 09:30:44 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pavel Shilovsky X-Patchwork-Id: 4522411 Return-Path: X-Original-To: patchwork-cifs-client@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id CE4709F26C for ; Thu, 10 Jul 2014 09:31:06 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 18038202F0 for ; Thu, 10 Jul 2014 09:31:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 47DC32024C for ; Thu, 10 Jul 2014 09:31:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752729AbaGJJbE (ORCPT ); Thu, 10 Jul 2014 05:31:04 -0400 Received: from mail-lb0-f170.google.com ([209.85.217.170]:45080 "EHLO mail-lb0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752663AbaGJJbD (ORCPT ); Thu, 10 Jul 2014 05:31:03 -0400 Received: by mail-lb0-f170.google.com with SMTP id 10so5902578lbg.15 for ; Thu, 10 Jul 2014 02:31:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:subject:date:message-id:in-reply-to:references; bh=WBinUkGFTnRBPSsbM192E8olpIrOI2jqhxLyH1ndT6w=; b=j3Z/SgYJreGVFzIxqZduuJ4bDyVroWc4ONEPEwUy7CMREJaDdArO7ti/TCengcpdVo VdHobROAMcimPz13VrlW05KNWhKNEA8oQ7oti4Is/v+J+tvuu0jonyMGuW2P0AFIcefH CzN5ySvN9fZRkKk5UMvYdO4iJ+984JGOhlyQi0WI+kR1qQaXYlcU16wVXSAG0g3z6GWL wH3qSdjvbqe80x13T94kxmrb/36vBfurWMiAYM0XFqbstaBDdvxC8FYHnn4bYLwZfH1J NwZxfkFiW+70aeTWp6Z8qSkrYJ+JU4iI/9LfOQboVmijtH4IZkz4R4a6hlompx1qoLgr 9sdg== X-Received: by 10.112.173.201 with SMTP id bm9mr3438274lbc.16.1404984662308; Thu, 10 Jul 2014 02:31:02 -0700 (PDT) Received: from localhost.localdomain ([92.43.3.36]) by mx.google.com with ESMTPSA id v6sm23257226lal.35.2014.07.10.02.31.00 for (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 10 Jul 2014 02:31:01 -0700 (PDT) From: Pavel Shilovsky To: linux-cifs@vger.kernel.org Subject: [PATCH 4/7] CIFS: Fix possible buffer corruption in direct read Date: Thu, 10 Jul 2014 13:30:44 +0400 Message-Id: <1404984647-8710-5-git-send-email-pshilovsky@samba.org> X-Mailer: git-send-email 1.8.1.2 In-Reply-To: <1404984647-8710-1-git-send-email-pshilovsky@samba.org> References: <1404984647-8710-1-git-send-email-pshilovsky@samba.org> Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If there was a short read in the middle of the rdata list, we can end up with a corrupt output buffer. Signed-off-by: Pavel Shilovsky --- fs/cifs/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index f6cb765..2927f02 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -3048,7 +3048,9 @@ again: } else { rc = cifs_readdata_to_iov(rdata, to); } - + /* if there was a short read -- discard anything left */ + if (rdata->got_bytes && rdata->got_bytes < rdata->bytes) + rc = -ENODATA; } list_del_init(&rdata->list); kref_put(&rdata->refcount, cifs_uncached_readdata_release);