Eugene Korenevsky a637f4ae03 cifs: fix out-of-bound memory access when calling smb3_notify() at mount point
If smb3_notify() is called at mount point of CIFS, build_path_from_dentry()
returns the pointer to kmalloc-ed memory with terminating zero (this is
empty FileName to be passed to SMB2 CREATE request). This pointer is assigned
to the `path` variable.
Then `path + 1` (to skip first backslash symbol) is passed to
cifs_convert_path_to_utf16(). This is incorrect for empty path and causes
out-of-bound memory access.

Get rid of this "increase by one". cifs_convert_path_to_utf16() already
contains the check for leading backslash in the path.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212693
CC: <stable@vger.kernel.org> # v5.6+
Signed-off-by: Eugene Korenevsky <ekorenevsky@astralinux.ru>
Signed-off-by: Steve French <stfrench@microsoft.com>
2021-04-25 16:28:24 -05:00
..
2020-10-22 12:17:52 -05:00
2020-06-01 00:10:18 -05:00
2021-04-25 16:28:22 -05:00
2020-06-01 00:10:18 -05:00
2021-04-25 16:28:23 -05:00
2021-04-25 16:28:23 -05:00
2020-08-02 18:00:25 -05:00
2019-01-24 09:37:33 -06:00
2021-03-14 18:14:32 -05:00
2021-04-25 16:28:23 -05:00