]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
cifs: fix underflow in parse_server_interfaces()
authorDan Carpenter <dan.carpenter@linaro.org>
Thu, 8 Feb 2024 10:18:46 +0000 (13:18 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 23 Feb 2024 08:51:33 +0000 (09:51 +0100)
commitdf2af9fdbc4ddde18a3371c4ca1a86596e8be301
treebc8a19204d194c09c29b32567aee10d863c60f24
parent94a3da1b9ba33a270877f4ac677e5f44edf0880f
cifs: fix underflow in parse_server_interfaces()

[ Upstream commit cffe487026be13eaf37ea28b783d9638ab147204 ]

In this loop, we step through the buffer and after each item we check
if the size_left is greater than the minimum size we need.  However,
the problem is that "bytes_left" is type ssize_t while sizeof() is type
size_t.  That means that because of type promotion, the comparison is
done as an unsigned and if we have negative bytes left the loop
continues instead of ending.

Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/smb/client/smb2ops.c