ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
commit a80a486d upstream. If ->NameOffset of smb2_create_req is smaller than Buffer offset of smb2_create_req, slab-out-of-bounds read can happen from smb2_open. This patch set the minimum value of the name offset to the buffer offset to validate name length of smb2_create_req(). Cc: stable@vger.kernel.org Reported-by:Xuanzhe Yu <yuxuanzhe@outlook.com> Signed-off-by:
Namjae Jeon <linkinjeon@kernel.org> Signed-off-by:
Steve French <stfrench@microsoft.com> Stable-dep-of: c6cd2e8d ("ksmbd: fix potencial out-of-bounds when buffer offset is invalid") Signed-off-by:
Vamsi Krishna Brahmajosyula <vamsi-krishna.brahmajosyula@broadcom.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Loading
Please register or sign in to comment