github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-27 11:02:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

smb: client: reject short Next offsets in parse_server_interfaces()

Browse Source 
In parse_server_interfaces(), the server-supplied Next offset is
validated against bytes_left, but not against the size of the interface
structure itself.

A small, non-zero Next value can pass the bounds check but advance the
pointer by less than sizeof(*p). This causes the next iteration of the
loop to read misaligned, overlapping structure fields.

Fix this by ensuring the Next offset is at least sizeof(*p).

Fixes: 7d34ec36ab ("smb3: fix for slab out of bounds on mount to ksmbd")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
This commit is contained in:
Frank Sorenson 2026-09-16 16:33:56 -05:00 committed by Paulo Alcantara
parent e83330c55e
commit 1b3221bb12
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/smb/client/smb2ops.c
View File

@ -785,9 +785,9 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
break;
}
/* Validate that Next doesn't point beyond the buffer */
if (next > bytes_left) {
cifs_dbg(VFS, "%s: invalid Next pointer %zu > %zd\n",
__func__, next, bytes_left);
if (next < sizeof(*p) || next > bytes_left) {
cifs_dbg(VFS, "%s: invalid Next pointer %zu out of range [%zu, %zd]\n",
__func__, next, sizeof(*p), bytes_left);
rc = -EINVAL;
goto out;
}