iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cifsd: Update out_buf_len in smb2_populate_readdir_entry()

Browse Source 
When processing a SMB2 QUERY_DIRECTORY request,
smb2_populate_readdir_entry() is called first to fill the dot/dotdot
entries. This moves the d_info->wptr pointer but out_buf_len remains
unchanged. As a result, reserve_populate_dentry() may end up writing
past the end of the buffer since the bounds checking is done on
invalid values.

Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Marios Makassikis 2021-05-06 11:40:02 +09:00 committed by Steve French
parent 79caa9606d
commit e7735c8548
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fs/cifsd/smb2pdu.c
View File

@ -3333,6 +3333,7 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
d_info->last_entry_offset = d_info->data_count;
d_info->data_count += next_entry_offset;
d_info->out_buf_len -= next_entry_offset;
d_info->wptr += next_entry_offset;
kfree(conv_name);