]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: the buffer of smb2 query dir response has at least 1 byte
authorNamjae Jeon <linkinjeon@kernel.org>
Tue, 20 Aug 2024 13:07:38 +0000 (22:07 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 29 Aug 2024 15:36:06 +0000 (17:36 +0200)
commitbfbf265172d7cf25fcb81be2abe955b845a23559
tree05cb8b48aeeb428924de841ef4faa2c1e6bc2f6b
parent75abfcf641d8efc485e753231356d14cdcb4918c
ksmbd: the buffer of smb2 query dir response has at least 1 byte

commit ce61b605a00502c59311d0a4b1f58d62b48272d0 upstream.

When STATUS_NO_MORE_FILES status is set to smb2 query dir response,
->StructureSize is set to 9, which mean buffer has 1 byte.
This issue occurs because ->Buffer[1] in smb2_query_directory_rsp to
flex-array.

Fixes: eb3e28c1e89b ("smb3: Replace smb2pdu 1-element arrays with flex-arrays")
Cc: stable@vger.kernel.org # v6.1+
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/smb2pdu.c