ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

Browse source

If ->NameOffset of smb2_create_req is smaller than Buffer offset of
smb2_create_req, slab-out-of-bounds read can happen from smb2_open.
This patch set the minimum value of the name offset to the buffer offset
to validate name length of smb2_create_req().

Cc: stable@vger.kernel.org
Reported-by: Xuanzhe Yu <yuxuanzhe@outlook.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

...

This commit is contained in:

Namjae Jeon 2024-03-16 23:36:36 +09:00 • committed by Steve French

parent e758fa6956

commit a80a486d72

1 changed files with 4 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

fs/smb/server/smb2misc.c

View file