ksmbd: add bounds check for create lease context

commit bab703ed8472aa9d109c5f8c1863921533363dae upstream.

Add missing bounds check for create lease context.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index d91493e3d75594d46526aa442f04ff34b438da3b..371a5ead86635d7d463c13cf0edb85bcd3326c55 100644 (file)
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1505,6 +1505,10 @@ struct lease_ctx_info *parse_lease_state(void *open_req)
        if (sizeof(struct lease_context_v2) == le32_to_cpu(cc->DataLength)) {
                struct create_lease_v2 *lc = (struct create_lease_v2 *)cc;
 
+               if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) <
+                   sizeof(struct create_lease_v2) - 4)
+                       return NULL;
+
                memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE);
                lreq->req_state = lc->lcontext.LeaseState;
                lreq->flags = lc->lcontext.LeaseFlags;
@@ -1517,6 +1521,10 @@ struct lease_ctx_info *parse_lease_state(void *open_req)
        } else {
                struct create_lease *lc = (struct create_lease *)cc;
 
+               if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) <
+                   sizeof(struct create_lease))
+                       return NULL;
+
                memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE);
                lreq->req_state = lc->lcontext.LeaseState;
                lreq->flags = lc->lcontext.LeaseFlags;