diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2023-08-06 02:44:17 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-08-06 04:57:00 +0300 |
| commit | 79ed288cef201f1f212dfb934bcaac75572fb8f6 (patch) | |
| tree | 5c150a82d16bcc035a83b130e4f1f2992a039db3 /fs/dlm/ast.h | |
| parent | 5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c (diff) | |
| download | linux-79ed288cef201f1f212dfb934bcaac75572fb8f6.tar.xz | |
ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request
from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of
current smb2_ea_info. ksmbd need to validate buffer length Before
accessing the next ea. ksmbd should check buffer length using buf_len,
not next variable. next is the start offset of current ea that got from
previous ea.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21598
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/dlm/ast.h')
0 files changed, 0 insertions, 0 deletions