diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-09-06 12:47:01 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-10-10 09:53:22 +0300 |
| commit | 3466db7bf72e80f1d5fe4aaf22fb1f9e59abb538 (patch) | |
| tree | 53f00970f1bb93d0215dfa5595a3e3e889f74719 /fs/cifs | |
| parent | 82e9788a693456aa47c5ef67654a4ba66cdd9ef2 (diff) | |
| download | linux-3466db7bf72e80f1d5fe4aaf22fb1f9e59abb538.tar.xz | |
cifs: read overflow in is_valid_oplock_break()
[ Upstream commit 097f5863b1a0c9901f180bbd56ae7d630655faaa ]
We need to verify that the "data_offset" is within bounds.
Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/cifs')
| -rw-r--r-- | fs/cifs/misc.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 323d8e34abde..50559a80acf8 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -406,9 +406,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) (struct smb_com_transaction_change_notify_rsp *)buf; struct file_notify_information *pnotify; __u32 data_offset = 0; + size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length); + if (get_bcc(buf) > sizeof(struct file_notify_information)) { data_offset = le32_to_cpu(pSMBr->DataOffset); + if (data_offset > + len - sizeof(struct file_notify_information)) { + cifs_dbg(FYI, "invalid data_offset %u\n", + data_offset); + return true; + } pnotify = (struct file_notify_information *) ((char *)&pSMBr->hdr.Protocol + data_offset); cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n", |