]> Git Repo - J-linux.git/commitdiff
ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
authorJordy Zomer <[email protected]>
Thu, 28 Nov 2024 00:33:25 +0000 (09:33 +0900)
committerSteve French <[email protected]>
Sun, 1 Dec 2024 23:31:19 +0000 (17:31 -0600)
An offset from client could be a negative value, It could allows
to write data outside the bounds of the allocated buffer.
Note that this issue is coming when setting
'vfs objects = streams_xattr parameter' in ksmbd.conf.

Cc: [email protected] # v5.15+
Reported-by: Jordy Zomer <[email protected]>
Signed-off-by: Jordy Zomer <[email protected]>
Signed-off-by: Namjae Jeon <[email protected]>
Signed-off-by: Steve French <[email protected]>
fs/smb/server/smb2pdu.c

index 7b6a3952f228e7938bad9681aaadb3a6bf1e50d3..23879555880fcb9ecb7e1506c940118973d39108 100644 (file)
@@ -6882,6 +6882,8 @@ int smb2_write(struct ksmbd_work *work)
        }
 
        offset = le64_to_cpu(req->Offset);
+       if (offset < 0)
+               return -EINVAL;
        length = le32_to_cpu(req->Length);
 
        if (req->Channel == SMB2_CHANNEL_RDMA_V1 ||
This page took 0.053864 seconds and 4 git commands to generate.