]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: validate length in smb2_write()
authorNamjae Jeon <linkinjeon@kernel.org>
Mon, 18 Dec 2023 15:32:52 +0000 (00:32 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Dec 2023 09:41:51 +0000 (10:41 +0100)
commit6bb4399303383c2c06bce33f2335c39fbf35d979
treef8b3b69e1766b8e79ceef24ea19f77ca08b93e1e
parent8e32e15840256c647fdfef02f5737a701edb3cb9
ksmbd: validate length in smb2_write()

[ Upstream commit 158a66b245739e15858de42c0ba60fcf3de9b8e6 ]

The SMB2 Write packet contains data that is to be written
to a file or to a pipe. Depending on the client, there may
be padding between the header and the data field.
Currently, the length is validated only in the case padding
is present.

Since the DataOffset field always points to the beginning
of the data, there is no need to have a special case for
padding. By removing this, the length is validated in both
cases.

Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ksmbd/smb2pdu.c