Dan Carpenter 2d204ee9d6 cifs: integer overflow in in SMB2_ioctl() ...

The "le32_to_cpu(rsp->OutputOffset) + *plen" addition can overflow and
wrap around to a smaller value which looks like it would lead to an
information leak.

Fixes: 4a72dafa19ba ("SMB2 FSCTL and IOCTL worker function")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
CC: Stable <stable@vger.kernel.org>

2018-09-12 09:32:07 -05:00

..

asn1.c

treewide: kmalloc() -> kmalloc_array()

2018-06-12 16:19:22 -07:00

cache.c

cifs: use 64-bit timestamps for fscache

2018-08-07 14:15:41 -05:00

cifs_debug.c

smb3: display stats counters for number of slow commands

2018-08-07 14:30:59 -05:00

cifs_debug.h

cifs: add server argument to the dump_detail method

2018-05-27 17:56:35 -05:00

cifs_dfs_ref.c

CIFS: add build_path_from_dentry_optional_prefix()

2017-03-01 22:26:10 -06:00

cifs_fs_sb.h

smb3: fix redundant opens on root

2018-05-27 17:56:35 -05:00

cifs_ioctl.h

Enable previous version support

2016-10-13 19:48:11 -05:00

cifs_spnego.c

cifs: Create dedicated keyring for spnego operations

2016-05-19 21:56:30 -05:00

cifs_spnego.h

…

cifs_unicode.c

fs/cifs: don't translate SFM_SLASH (U+F026) to backslash

2018-09-02 23:21:42 -05:00

cifs_unicode.h

[SMB3] Remove ifdef since SMB3 (and later) now STRONGLY preferred

2017-07-08 18:57:07 -05:00

cifs_uniupr.h

…

cifsacl.c

treewide: kmalloc() -> kmalloc_array()

2018-06-12 16:19:22 -07:00

cifsacl.h

cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class

2018-06-04 19:19:24 -05:00

cifsencrypt.c

cifs: Make sure all data pages are signed correctly

2018-08-07 14:15:41 -05:00

cifsfs.c

cifs: don't show domain= in mount output when domain is empty

2018-08-10 11:53:51 -05:00

cifsfs.h

cifs: update internal module version number for cifs.ko to 2.12

2018-08-23 15:11:10 -05:00

cifsglob.h

cifs: update receive_encrypted_standard to handle compounded responses

2018-08-09 21:19:45 -05:00

cifspdu.h

CIFS: move DFS response parsing out of SMB1 code

2017-03-01 22:26:10 -06:00

cifsproto.h

cifs: add compound_send_recv()

2018-08-07 14:23:20 -05:00

cifssmb.c

fs/cifs: suppress a string overflow warning

2018-09-09 00:02:39 -05:00

connect.c

cifs: connect to servername instead of IP for IPC$ share

2018-09-02 23:21:42 -05:00

dir.c

get rid of 'opened' argument of ->atomic_open() - part 3

2018-07-12 10:04:20 -04:00

dns_resolve.c

cifs: fix composing of mount options for DFS referrals

2013-05-24 13:08:31 -05:00

dns_resolve.h

…

export.c

[CIFS] cifs: Rename cERROR and cFYI to cifs_dbg

2013-05-04 22:17:23 -05:00

file.c

treewide: kzalloc() -> kcalloc()

2018-06-12 16:19:22 -07:00

fscache.c

cifs: use 64-bit timestamps for fscache

2018-08-07 14:15:41 -05:00

fscache.h

cifs: use 64-bit timestamps for fscache

2018-08-07 14:15:41 -05:00

inode.c

SMB3: Backup intent flag missing for directory opens with backupuid mounts

2018-09-02 23:21:42 -05:00

ioctl.c

[SMB3] Remove ifdef since SMB3 (and later) now STRONGLY preferred

2017-07-08 18:57:07 -05:00

Kconfig

fs/cifs: require sha512

2018-09-09 00:04:27 -05:00

link.c

smb3: don't request leases in symlink creation and query

2018-08-07 14:15:57 -05:00

Makefile

smb3: Add ftrace tracepoints for improved SMB3 debugging

2018-05-27 17:56:35 -05:00

misc.c

cifs: simple stats should always be enabled

2018-08-07 14:20:22 -05:00

netmisc.c

cifs: use timespec64 internally

2018-08-07 14:15:41 -05:00

nterr.c

CIFS: Rename 7 error codes to NT_ style

2012-07-24 10:25:10 -05:00

nterr.h

CIFS: Rename 7 error codes to NT_ style

2012-07-24 10:25:10 -05:00

ntlmssp.h

cifs: dynamic allocation of ntlmssp blob

2016-06-23 23:45:07 -05:00

readdir.c

cifs: prevent integer overflow in nxt_dir_entry()

2018-09-12 09:27:57 -05:00

rfc1002pdu.h

…

sess.c

cifs: check kmalloc before use

2018-08-23 15:10:49 -05:00

smb1ops.c

cifs: simple stats should always be enabled

2018-08-07 14:20:22 -05:00

smb2file.c

cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf()

2018-07-05 13:48:25 -05:00

smb2glob.h

cifs: remove struct smb2_hdr

2018-06-01 09:14:30 -05:00

smb2inode.c

smb3: Do not send SMB3 SET_INFO if nothing changed

2018-08-07 14:30:59 -05:00

smb2maperror.c

cifs: remove struct smb2_hdr

2018-06-01 09:14:30 -05:00

smb2misc.c

smb3: minor debugging clarifications in rfc1001 len processing

2018-09-02 23:21:42 -05:00

smb2ops.c

smb3: check for and properly advertise directory lease support

2018-09-02 23:21:42 -05:00

smb2pdu.c

cifs: integer overflow in in SMB2_ioctl()

2018-09-12 09:32:07 -05:00

smb2pdu.h

cifs: create a define for how many iovs we need for an SMB2_open()

2018-08-23 15:10:40 -05:00

smb2proto.h

cifs: update smb2_queryfs() to use compounding

2018-08-09 21:19:56 -05:00

smb2status.h

CIFS: Add SMB2 status codes

2012-07-24 10:25:13 -05:00

smb2transport.c

CIFS: fix uninitialized ptr deref in smb2 signing

2018-08-07 14:30:59 -05:00

smbdirect.c

Linux 4.18

2018-08-16 13:12:00 -06:00

smbdirect.h

cifs: fix SMB1 breakage

2018-07-05 13:48:24 -05:00

smbencrypt.c

CIFS: refactor crypto shash/sdesc allocation&free

2018-04-01 20:24:39 -05:00

smberr.h

…

smbfsctl.h

[SMB3] Send durable handle v2 contexts when use of persistent handles required

2015-11-03 09:26:27 -06:00

trace.c

smb3: Add ftrace tracepoints for improved SMB3 debugging

2018-05-27 17:56:35 -05:00

trace.h

smb3: add tracepoint for slow responses

2018-08-07 14:28:01 -05:00

transport.c

cifs: update receive_encrypted_standard to handle compounded responses

2018-08-09 21:19:45 -05:00

winucase.c

[CIFS] quiet sparse compile warning

2013-09-08 14:54:24 -05:00

xattr.c

smb3: create smb3 equivalent alias for cifs pseudo-xattrs

2018-08-10 18:46:58 -05:00