diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES index 70c90c07edf105285843a61690bb57853448ce3a..2459ef0a1396784d0f9f1280b3fc1e04267ade77 100644 --- a/fs/cifs/CHANGES +++ b/fs/cifs/CHANGES @@ -10,7 +10,8 @@ opened, read and written as if they were files). When 1st tree connect fails (e.g. due to signing negotiation failure) fix leak that causes cifsd not to stop and rmmod to fail to cleanup cifs_request_buffers pool. Fix problem with POSIX Open/Mkdir on -bigendian architectures. +bigendian architectures. Fix possible memory corruption when +EAGAIN returned on kern_recvmsg. Version 1.50 ------------ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 494455ed4352687294a57993821834d6b0a37238..676bbf2bb56d8efc305afd7a1ca139cafcf85f0a 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -415,7 +415,10 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server) msleep(1); /* minimum sleep to prevent looping allowing socket to clear and app threads to set tcpStatus CifsNeedReconnect if server hung */ - continue; + if (pdu_length < 4) + goto incomplete_rcv; + else + continue; } else if (length <= 0) { if (server->tcpStatus == CifsNew) { cFYI(1, ("tcp session abend after SMBnegprot")); @@ -543,6 +546,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server) allowing socket to clear and app threads to set tcpStatus CifsNeedReconnect if server hung*/ + length = 0; continue; } else if (length <= 0) { cERROR(1, ("Received no data, expecting %d",