Unverified Commit 290fa550 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15799 ksmbd: fix incorrect validation for num_aces field of smb_acl 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongjian Sun <sunyongjian1@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/E6245L3XK2JY6S5QTDIGPLP76RHYWSNS/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBYED0 
 
Link:https://gitee.com/openeuler/kernel/pulls/15799

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 575bcc0b 9f43c59b

fs/smb/server/smbacl.c

+4 −1
Original line number Diff line number Diff line
@@ -398,7 +398,9 @@ static void parse_dacl(struct mnt_idmap *idmap, 
	if (num_aces <= 0)

		return;



	if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))

	if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) /

			(offsetof(struct smb_ace, sid) +

			 offsetof(struct smb_sid, sub_auth) + sizeof(__le16)))

		return;



	ret = init_acl_state(&acl_state, num_aces);
@@ -432,6 +434,7 @@ static void parse_dacl(struct mnt_idmap *idmap, 
			offsetof(struct smb_sid, sub_auth);



		if (end_of_acl - acl_base < acl_size ||

		    ppace[i]->sid.num_subauth == 0 ||

		    ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES ||

		    (end_of_acl - acl_base <

		     acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) ||