mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-29 23:53:32 +00:00
64b7f674c2
On setxattr() syscall path due to an apprent typo the size of a dynamically
allocated memory chunk for storing struct smb2_file_full_ea_info object is
computed incorrectly, to be more precise the first addend is the size of
a pointer instead of the wanted object size. Coincidentally it makes no
difference on 64-bit platforms, however on 32-bit targets the following
memcpy() writes 4 bytes of data outside of the dynamically allocated memory.
=============================================================================
BUG kmalloc-16 (Not tainted): Redzone overwritten
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: 0x79e69a6f-0x9e5cdecf @offset=368. First byte 0x73 instead of 0xcc
INFO: Slab 0xd36d2454 objects=85 used=51 fp=0xf7d0fc7a flags=0x35000201
INFO: Object 0x6f171df3 @offset=352 fp=0x00000000
Redzone 5d4ff02d: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 6f171df3: 00 00 00 00 00 05 06 00 73 6e 72 75 62 00 66 69 ........snrub.fi
Redzone 79e69a6f: 73 68 32 0a sh2.
Padding 56254d82: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
CPU: 0 PID: 8196 Comm: attr Tainted: G B 5.9.0-rc8+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
Call Trace:
dump_stack+0x54/0x6e
print_trailer+0x12c/0x134
check_bytes_and_report.cold+0x3e/0x69
check_object+0x18c/0x250
free_debug_processing+0xfe/0x230
__slab_free+0x1c0/0x300
kfree+0x1d3/0x220
smb2_set_ea+0x27d/0x540
cifs_xattr_set+0x57f/0x620
__vfs_setxattr+0x4e/0x60
__vfs_setxattr_noperm+0x4e/0x100
__vfs_setxattr_locked+0xae/0xd0
vfs_setxattr+0x4e/0xe0
setxattr+0x12c/0x1a0
path_setxattr+0xa4/0xc0
__ia32_sys_lsetxattr+0x1d/0x20
__do_fast_syscall_32+0x40/0x70
do_fast_syscall_32+0x29/0x60
do_SYSENTER_32+0x15/0x20
entry_SYSENTER_32+0x9f/0xf2
Fixes:
|
||
---|---|---|
.. | ||
asn1.c | ||
cache.c | ||
cifs_debug.c | ||
cifs_debug.h | ||
cifs_dfs_ref.c | ||
cifs_fs_sb.h | ||
cifs_ioctl.h | ||
cifs_spnego.c | ||
cifs_spnego.h | ||
cifs_unicode.c | ||
cifs_unicode.h | ||
cifs_uniupr.h | ||
cifsacl.c | ||
cifsacl.h | ||
cifsencrypt.c | ||
cifsfs.c | ||
cifsfs.h | ||
cifsglob.h | ||
cifspdu.h | ||
cifsproto.h | ||
cifsroot.c | ||
cifssmb.c | ||
connect.c | ||
dfs_cache.c | ||
dfs_cache.h | ||
dir.c | ||
dns_resolve.c | ||
dns_resolve.h | ||
export.c | ||
file.c | ||
fscache.c | ||
fscache.h | ||
inode.c | ||
ioctl.c | ||
Kconfig | ||
link.c | ||
Makefile | ||
misc.c | ||
netmisc.c | ||
nterr.c | ||
nterr.h | ||
ntlmssp.h | ||
readdir.c | ||
rfc1002pdu.h | ||
sess.c | ||
smb1ops.c | ||
smb2file.c | ||
smb2glob.h | ||
smb2inode.c | ||
smb2maperror.c | ||
smb2misc.c | ||
smb2ops.c | ||
smb2pdu.c | ||
smb2pdu.h | ||
smb2proto.h | ||
smb2status.h | ||
smb2transport.c | ||
smbdirect.c | ||
smbdirect.h | ||
smbencrypt.c | ||
smberr.h | ||
smbfsctl.h | ||
trace.c | ||
trace.h | ||
transport.c | ||
winucase.c | ||
xattr.c |