cifs: Increase size of tmp_buf in cifs_readdir to avoid potential overflows

Commit 7b0c8fcff47a885743125dd843db64af41af5a61 refreshed and use
a #define from commit f58841666bc22e827ca0dcef7b71c7bc2758ce82.

cifs: Increase size of tmp_buf in cifs_readdir to avoid potential overflows

Increase size of tmp_buf to possible maximum to avoid potential
overflows. Also moved UNICODE_NAME_MAX definition so that it can be used
elsewhere.

Pointed-out-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 14eb9a2395d3cc3c4020e08c01d8b3b5dbc9faa0..604ce8a526a407b36228f1a5b052b1b40a5e3c94 100644 (file)
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -63,6 +63,13 @@ int cifs_strfromUCS_le(char *, const __le16 *, int, const struct nls_table *);
 int cifs_strtoUCS(__le16 *, const char *, int, const struct nls_table *);
 #endif
 
+/*
+ * To be safe - for UCS to UTF-8 with strings loaded with the rare long
+ * characters alloc more to account for such multibyte target UTF-8
+ * characters.
+ */
+#define UNICODE_NAME_MAX ((4 * NAME_MAX) + 2)
+
 /*
  * UniStrcat:  Concatenate the second string to the first
  *

diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 58d57299f2a08c432625f9be298e731e2fa7bae0..2878892688cb27398e0446adf33362ea91a23f07 100644 (file)
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -1075,7 +1075,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                with the rare long characters alloc more to account for
                such multibyte target UTF-8 characters. cifs_unicode.c,
                which actually does the conversion, has the same limit */
-               tmp_buf = kmalloc((2 * NAME_MAX) + 4, GFP_KERNEL);
+               tmp_buf = kmalloc(UNICODE_NAME_MAX, GFP_KERNEL);
                for (i = 0; (i < num_to_fill) && (rc == 0); i++) {
                        if (current_entry == NULL) {
                                /* evaluate whether this case is an error */