Unverified Commit 9d808811 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1911 ksmbd: fix out-of-bound read in smb2_write 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/HHXTEKWL4Z4QJ3KP2L5HPOTKEBYCOF2D/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7ST5T 
 
Link:https://gitee.com/openeuler/kernel/pulls/1911

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents d4bd6f22 a85ddaec

fs/ksmbd/smb2misc.c

+9 −3
Original line number Diff line number Diff line
@@ -356,10 +356,16 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work) 
	int command;

	__u32 clc_len;  /* calculated length */

	__u32 len = get_rfc1002_len(work->request_buf);

	__u32 req_struct_size;

	__u32 req_struct_size, next_cmd = le32_to_cpu(hdr->NextCommand);



	if (le32_to_cpu(hdr->NextCommand) > 0)

		len = le32_to_cpu(hdr->NextCommand);

	if ((u64)work->next_smb2_rcv_hdr_off + next_cmd > len) {

		pr_err("next command(%u) offset exceeds smb msg size\n",

				next_cmd);

		return 1;

	}



	if (next_cmd > 0)

		len = next_cmd;

	else if (work->next_smb2_rcv_hdr_off)

		len -= work->next_smb2_rcv_hdr_off;