cifs: fix underflow in parse_server_interfaces()
mainline inclusion from mainline-v6.8-rc4 commit cffe487026be13eaf37ea28b783d9638ab147204 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJRD CVE: CVE-2024-26828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cffe487026be13eaf37ea28b783d9638ab147204 -------------------------------- In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending. Fixes: fe856be4 ("CIFS: parse and store info on iface queries") Signed-off-by:Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by:
Shyam Prasad N <sprasad@microsoft.com> Signed-off-by:
Steve French <stfrench@microsoft.com> Conflict: fs/cifs/smb2ops.c Signed-off-by:
Long Li <leo.lilong@huawei.com>
Loading
Please sign in to comment