]> git.ipfire.org Git - thirdparty/linux.git/commit
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
authorNamjae Jeon <linkinjeon@kernel.org>
Thu, 11 Apr 2024 14:02:15 +0000 (23:02 +0900)
committerSteve French <stfrench@microsoft.com>
Sat, 20 Apr 2024 01:48:47 +0000 (20:48 -0500)
commitc119f4ede3fa90a9463f50831761c28f989bfb20
tree37ab574a68c2d9d7d2767ee674b1ebde287bc7a0
parent0bbac3facb5d6cc0171c45c9873a2dc96bea9680
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf

If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size
validation could be skipped. if request size is smaller than
sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in
smb2_allocate_rsp_buf(). This patch allocate response buffer after
decrypting transform request. smb3_decrypt_req() will validate transform
request size and avoid slab-out-of-bound in smb2_allocate_rsp_buf().

Reported-by: Norbert Szetei <norbert@doyensec.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/server.c