]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: prevent out-of-bounds stream writes by validating *pos
authorNorbert Szetei <norbert@doyensec.com>
Thu, 1 May 2025 23:21:58 +0000 (08:21 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 18 May 2025 06:21:20 +0000 (08:21 +0200)
commit7f61da79df86fd140c7768e668ad846bfa7ec8e1
tree8e7dbb88184131375a155817d95e8d6b4f4fb1f9
parent7fbb439ee2295fc62462c6f747c461b9203f14c6
ksmbd: prevent out-of-bounds stream writes by validating *pos

commit 0ca6df4f40cf4c32487944aaf48319cb6c25accc upstream.

ksmbd_vfs_stream_write() did not validate whether the write offset
(*pos) was within the bounds of the existing stream data length (v_len).
If *pos was greater than or equal to v_len, this could lead to an
out-of-bounds memory write.

This patch adds a check to ensure *pos is less than v_len before
proceeding. If the condition fails, -EINVAL is returned.

Cc: stable@vger.kernel.org
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/vfs.c