]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
authorNamjae Jeon <linkinjeon@kernel.org>
Wed, 10 Sep 2025 02:22:52 +0000 (11:22 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Sep 2025 09:16:45 +0000 (11:16 +0200)
commit529b121b00a6ee3c88fb3c01b443b2b81f686d48
tree33b3e7e709e83eb1c1743e0d15837fa56d676c54
parent5ca20bb7b4bde72110c3ae78423cbfdd0157aa36
ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

commit 5282491fc49d5614ac6ddcd012e5743eecb6a67c upstream.

If data_offset and data_length of smb_direct_data_transfer struct are
invalid, out of bounds issue could happen.
This patch validate data_offset and data_length field in recv_done.

Cc: stable@vger.kernel.org
Fixes: 2ea086e35c3d ("ksmbd: add buffer validation for smb direct")
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reported-by: Luigino Camastra, Aisle Research <luigino.camastra@aisle.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/transport_rdma.c