ksmbd: prevent out-of-bounds reads in share config responses

Browse source

Validate IPC share configuration payload sizes before consuming
variable-length fields. Bound veto list parsing and account for
the separator byte when deriving the path length.

Fixes: a677ebd8ca ("ksmbd: validate payload size in ipc response")
Reported-by: Kanishka De Silva <kpskanna1915@gmail.com>
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

...

This commit is contained in:

Namjae Jeon 2026-08-28 08:39:57 +09:00

parent feca5e70fc

commit f25e93768f

2 changed files with 41 additions and 20 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

40

fs/smb/server/mgmt/share_config.c

View file

21

fs/smb/server/transport_ipc.c

View file