ksmbd: validate payload size in ipc response

Browse source

If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc
response to ksmbd kernel server. ksmbd should validate payload size of
ipc response from ksmbd.mountd to avoid memory overrun or
slab-out-of-bounds. This patch validate 3 ipc response that has payload.

Cc: stable@vger.kernel.org
Reported-by: Chao Ma <machao2019@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

...

This commit is contained in:

Namjae Jeon 2024-03-31 21:59:10 +09:00 • committed by Steve French

parent c1832f6703

commit a677ebd8ca

3 changed files with 45 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

fs/smb/server/ksmbd_netlink.h

View file

7

fs/smb/server/mgmt/share_config.c

View file

37

fs/smb/server/transport_ipc.c

View file