summaryrefslogtreecommitdiff
path: root/fs/cifs
diff options
context:
space:
mode:
authorPavel Shilovsky <pshilovsky@samba.org>2014-07-10 10:21:15 +0400
committerSteve French <smfrench@gmail.com>2014-08-02 10:23:04 +0400
commit2e8a05d80213cdfbf3bf8e6eb3059831c7015e89 (patch)
tree571a362d0bb4af0d8e2a7e60b9082d906221b329 /fs/cifs
parentb3160aebb49b5e07f6bc3b8c5bed6013ca9e422e (diff)
downloadlinux-2e8a05d80213cdfbf3bf8e6eb3059831c7015e89.tar.xz
CIFS: Fix possible buffer corruption in cifs_user_read()
If there was a short read in the middle of the rdata list, we can end up with a corrupt output buffer. Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org> Signed-off-by: Steve French <smfrench@gmail.com>
Diffstat (limited to 'fs/cifs')
-rw-r--r--fs/cifs/file.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 3ea6fc86a471..c3390e2c6e0d 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -3049,7 +3049,9 @@ again:
} else {
rc = cifs_readdata_to_iov(rdata, to);
}
-
+ /* if there was a short read -- discard anything left */
+ if (rdata->got_bytes && rdata->got_bytes < rdata->bytes)
+ rc = -ENODATA;
}
list_del_init(&rdata->list);
kref_put(&rdata->refcount, cifs_uncached_readdata_release);