From f19811b1dfaba66ec2845a1523825397478b5980 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 7 Jan 2023 10:31:31 +0100 Subject: [PATCH] 5.4-stable patches added patches: cifs-prevent-copying-past-input-buffer-boundaries.patch --- ...copying-past-input-buffer-boundaries.patch | 42 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 43 insertions(+) create mode 100644 queue-5.4/cifs-prevent-copying-past-input-buffer-boundaries.patch diff --git a/queue-5.4/cifs-prevent-copying-past-input-buffer-boundaries.patch b/queue-5.4/cifs-prevent-copying-past-input-buffer-boundaries.patch new file mode 100644 index 00000000000..2eb917ec96e --- /dev/null +++ b/queue-5.4/cifs-prevent-copying-past-input-buffer-boundaries.patch @@ -0,0 +1,42 @@ +From 9ee2afe5207b63b20426ee081f486d831bae871d Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Thu, 6 Oct 2022 13:04:05 -0300 +Subject: cifs: prevent copying past input buffer boundaries + +From: Paulo Alcantara + +commit 9ee2afe5207b63b20426ee081f486d831bae871d upstream. + +Prevent copying past @data buffer in smb2_validate_and_copy_iov() as +the output buffer in @iov might be potentially bigger and thus copying +more bytes than requested in @minbufsize. + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Cc: Georg Müller +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/smb2pdu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3071,7 +3071,7 @@ smb2_validate_and_copy_iov(unsigned int + if (rc) + return rc; + +- memcpy(data, begin_of_buf, buffer_length); ++ memcpy(data, begin_of_buf, minbufsize); + + return 0; + } +@@ -3192,7 +3192,7 @@ query_info(const unsigned int xid, struc + + rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), + le32_to_cpu(rsp->OutputBufferLength), +- &rsp_iov, min_len, *data); ++ &rsp_iov, dlen ? *dlen : min_len, *data); + if (rc && allocated) { + kfree(*data); + *data = NULL; diff --git a/queue-5.4/series b/queue-5.4/series index 85d727e3380..d7c93392821 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -535,3 +535,4 @@ ext4-initialize-quota-before-expanding-inode-in-setproject-ioctl.patch ext4-avoid-unaccounted-block-allocation-when-expanding-inode.patch ext4-allocate-extended-attribute-value-in-vmalloc-area.patch drm-amdgpu-make-display-pinning-more-flexible-v2.patch +cifs-prevent-copying-past-input-buffer-boundaries.patch -- 2.47.3