diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2023-08-06 08:44:17 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-08-05 20:57:00 -0500 |
| commit | 79ed288cef201f1f212dfb934bcaac75572fb8f6 (patch) | |
| tree | 5c150a82d16bcc035a83b130e4f1f2992a039db3 | |
| parent | 5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c (diff) | |
| download | nf-79ed288cef201f1f212dfb934bcaac75572fb8f6.tar.gz | |
ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request
from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of
current smb2_ea_info. ksmbd need to validate buffer length Before
accessing the next ea. ksmbd should check buffer length using buf_len,
not next variable. next is the start offset of current ea that got from
previous ea.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21598
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 9849d748934599..7cc1b0c47d0a20 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2324,9 +2324,16 @@ next: break; buf_len -= next; eabuf = (struct smb2_ea_info *)((char *)eabuf + next); - if (next < (u32)eabuf->EaNameLength + le16_to_cpu(eabuf->EaValueLength)) + if (buf_len < sizeof(struct smb2_ea_info)) { + rc = -EINVAL; break; + } + if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + + le16_to_cpu(eabuf->EaValueLength)) { + rc = -EINVAL; + break; + } } while (next != 0); kfree(attr_name); |