]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ksmbd: validate compression Flags before kvmalloc
authorAnatolii Shumak <anatoliy.shumak@gmail.com>
Sat, 1 Aug 2026 05:19:53 +0000 (08:19 +0300)
committerSteve French <stfrench@microsoft.com>
Mon, 3 Aug 2026 16:21:22 +0000 (11:21 -0500)
commitba3afa8ccd154962c4a6b975b6e8b11027c5ab95
tree6fb9559341eeb175e786700cc2f523bfa3947268
parent0710dd08824a6f3b9892fc5be24acd2e4a36f178
ksmbd: validate compression Flags before kvmalloc

ksmbd_decompress_request() allocated the decompressed request buffer
before smb_compression_decompress() rejected unknown transform Flags or
chained mode when it was not negotiated. A remote peer could force a
transient multi-megabyte allocation that was immediately freed on
-EINVAL.

Validate CHAINED/NONE Flags and compress_chained before kvmalloc.

Link: https://github.com/namjaejeon/ksmbd/issues/529
Fixes: a08de24c2b85 ("ksmbd: negotiate and decode SMB2 compression")
Signed-off-by: Anatolii Shumak <anatoliy.shumak@gmail.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/compress.c