TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ksmbd: add bounds check for durable handle context

Browse Source 
Add missing bounds check for durable handle context.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Namjae Jeon
2025-03-14 18:21:47 +09:00
committed by Steve French
parent ae989ee1d3
commit 542027e123
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/smb/server/smb2pdu.c
+21
View File
@@ -2708,6 +2708,13 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
goto out;
}
if (le16_to_cpu(context->DataOffset) +
le32_to_cpu(context->DataLength) <
sizeof(struct create_durable_reconn_v2_req)) {
err = -EINVAL;
goto out;
}
recon_v2 = (struct create_durable_reconn_v2_req *)context;
persistent_id = recon_v2->Fid.PersistentFileId;
dh_info->fp = ksmbd_lookup_durable_fd(persistent_id);
@@ -2741,6 +2748,13 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
goto out;
}
if (le16_to_cpu(context->DataOffset) +
le32_to_cpu(context->DataLength) <
sizeof(struct create_durable_reconn_req)) {
err = -EINVAL;
goto out;
}
recon = (struct create_durable_reconn_req *)context;
persistent_id = recon->Data.Fid.PersistentFileId;
dh_info->fp = ksmbd_lookup_durable_fd(persistent_id);
@@ -2766,6 +2780,13 @@ static int parse_durable_handle_context(struct ksmbd_work *work,
goto out;
}
if (le16_to_cpu(context->DataOffset) +
le32_to_cpu(context->DataLength) <
sizeof(struct create_durable_req_v2)) {
err = -EINVAL;
goto out;
}
durable_v2_blob =
(struct create_durable_req_v2 *)context;
ksmbd_debug(SMB, "Request for durable v2 open\n");