kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/fs/smb
History
Qianchang Zhao 867ffd9d67 ksmbd: transport_ipc: validate payload size before reading handle 
commit 6f40e50ceb upstream.

handle_response() dereferences the payload as a 4-byte handle without
verifying that the declared payload size is at least 4 bytes. A malformed
or truncated message from ksmbd.mountd can lead to a 4-byte read past the
declared payload size. Validate the size before dereferencing.

This is a minimal fix to guard the initial handle read.

Fixes: 0626e6641f ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-29 14:10:32 +01:00
..
client cifs: Fix TCP_Server_Info::credits to be signed 2025-10-29 14:10:23 +01:00
common smb: smbdirect: add smbdirect_socket.{send,recv}_io.mem.{cache,pool} 2025-08-06 15:18:58 -05:00
server ksmbd: transport_ipc: validate payload size before reading handle 2025-10-29 14:10:32 +01:00
Kconfig smb: move client and server files to common directory fs/smb 2023-05-24 16:29:21 -05:00
Makefile smb: move client and server files to common directory fs/smb 2023-05-24 16:29:21 -05:00