]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
cifs: Validate content of NFS reparse point buffer
authorPali Rohár <pali@kernel.org>
Sat, 28 Sep 2024 21:59:47 +0000 (23:59 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 1 Nov 2024 01:02:34 +0000 (02:02 +0100)
commit1e5a2ecf31d7e2b9dd59a1b2d7ac045631b662ec
tree326324602627c595199875cfd1786772ecb8637c
parenteba591dee39d197f1b178d2021158582221ff56f
cifs: Validate content of NFS reparse point buffer

[ Upstream commit 556ac52bb1e76cc28fd30aa117b42989965b3efd ]

Symlink target location stored in DataBuffer is encoded in UTF-16. So check
that symlink DataBuffer length is non-zero and even number. And check that
DataBuffer does not contain UTF-16 null codepoint because Linux cannot
process symlink with null byte.

DataBuffer for char and block devices is 8 bytes long as it contains two
32-bit numbers (major and minor). Add check for this.

DataBuffer buffer for sockets and fifos zero-length. Add checks for this.

Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/smb/client/reparse.c