Unverified Commit 159042ec authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13343 [sync] PR-13339: smb: client: fix OOBs when building SMB2_IOCTL request 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/13339 
 
PR sync from: Baokun Li <libaokun1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/HL4HYFXN5OPT6XXEUUAZMR37JFL7MUMR/ 
 
https://gitee.com/src-openeuler/kernel/issues/IB3D6J 
 
Link:https://gitee.com/openeuler/kernel/pulls/13343

 

Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 88a9bf02 980337fa

fs/cifs/smb2pdu.c

+9 −0
Original line number Diff line number Diff line
@@ -2967,6 +2967,15 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 
		return rc;



	if (indatalen) {

		unsigned int len;



		if (WARN_ON_ONCE(smb3_encryption_required(tcon) &&

				 (check_add_overflow(total_len - 1,

						     ALIGN(indatalen, 8), &len) ||

				  len > MAX_CIFS_SMALL_BUFFER_SIZE))) {

			cifs_small_buf_release(req);

			return -EIO;

		}

		/*

		 * indatalen is usually small at a couple of bytes max, so

		 * just allocate through generic pool