Commit 44ed0921 authored by Dan Carpenter's avatar Dan Carpenter Committed by Long Li
Browse files

cifs: fix underflow in parse_server_interfaces()

mainline inclusion
from mainline-v6.8-rc4
commit cffe487026be13eaf37ea28b783d9638ab147204
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJRD
CVE: CVE-2024-26828

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cffe487026be13eaf37ea28b783d9638ab147204



--------------------------------

In this loop, we step through the buffer and after each item we check
if the size_left is greater than the minimum size we need.  However,
the problem is that "bytes_left" is type ssize_t while sizeof() is type
size_t.  That means that because of type promotion, the comparison is
done as an unsigned and if we have negative bytes left the loop
continues instead of ending.

Fixes: fe856be4 ("CIFS: parse and store info on iface queries")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarShyam Prasad N <sprasad@microsoft.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>

Conflict:
	fs/cifs/smb2ops.c

Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
parent 5d7f26cf
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment