Commit 85e0fbfb authored by Haoxiang Li's avatar Haoxiang Li Committed by Li Lingfeng
Browse files

smb: client: Add check for next_buffer in receive_encrypted_standard() 

stable inclusion
from stable-v6.6.80
commit 9e5d99a4cf2e23c716b44862975548415fae5391
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZD
CVE: CVE-2025-21844

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9e5d99a4cf2e23c716b44862975548415fae5391



--------------------------------

commit 860ca5e50f73c2a1cef7eefc9d39d04e275417f7 upstream.

Add check for the return value of cifs_buf_get() and cifs_small_buf_get()
in receive_encrypted_standard() to prevent null pointer dereference.

Fixes: eec04ea11969 ("smb: client: fix OOB in receive_encrypted_standard()")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarHaoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 010e974a

fs/smb/client/smb2ops.c

+4 −0
Original line number Diff line number Diff line
@@ -4904,6 +4904,10 @@ receive_encrypted_standard(struct TCP_Server_Info *server, 
			next_buffer = (char *)cifs_buf_get();

		else

			next_buffer = (char *)cifs_small_buf_get();

		if (!next_buffer) {

			cifs_server_dbg(VFS, "No memory for (large) SMB response\n");

			return -1;

		}

		memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd);

	}