]> git.hungrycats.org Git - linux/commit
ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
authorNamjae Jeon <linkinjeon@kernel.org>
Sat, 16 Mar 2024 14:36:36 +0000 (23:36 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 22 Nov 2024 14:37:33 +0000 (15:37 +0100)
commitd70c2e0904ab3715c5673fd45788a464a246d1db
tree950ced474652c367d705473f54166dbf0f591ef5
parent5ecf539bc5b2fd0dc9700f459704922714ad5cff
ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

commit a80a486d72e20bd12c335bcd38b6e6f19356b0aa upstream.

If ->NameOffset of smb2_create_req is smaller than Buffer offset of
smb2_create_req, slab-out-of-bounds read can happen from smb2_open.
This patch set the minimum value of the name offset to the buffer offset
to validate name length of smb2_create_req().

Cc: stable@vger.kernel.org
Reported-by: Xuanzhe Yu <yuxuanzhe@outlook.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: c6cd2e8d2d9a ("ksmbd: fix potencial out-of-bounds when buffer offset is invalid")
Signed-off-by: Vamsi Krishna Brahmajosyula <vamsi-krishna.brahmajosyula@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/smb2misc.c