38 lines
1.2 KiB
Diff
38 lines
1.2 KiB
Diff
From fb87d390de327c76b11ed544de83771118f7b0c5 Mon Sep 17 00:00:00 2001
|
|
From: Norbert Szetei <norbert@doyensec.com>
|
|
Date: Fri, 2 May 2025 08:21:58 +0900
|
|
Subject: ksmbd: prevent out-of-bounds stream writes by validating *pos
|
|
|
|
ksmbd_vfs_stream_write() did not validate whether the write offset
|
|
(*pos) was within the bounds of the existing stream data length (v_len).
|
|
If *pos was greater than or equal to v_len, this could lead to an
|
|
out-of-bounds memory write.
|
|
|
|
This patch adds a check to ensure *pos is less than v_len before
|
|
proceeding. If the condition fails, -EINVAL is returned.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
|
|
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
Signed-off-by: Steve French <stfrench@microsoft.com>
|
|
---
|
|
fs/smb/server/vfs.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
--- a/fs/smb/server/vfs.c
|
|
+++ b/fs/smb/server/vfs.c
|
|
@@ -443,6 +443,13 @@ static int ksmbd_vfs_stream_write(struct
|
|
goto out;
|
|
}
|
|
|
|
+ if (v_len <= *pos) {
|
|
+ pr_err("stream write position %lld is out of bounds (stream length: %zd)\n",
|
|
+ *pos, v_len);
|
|
+ err = -EINVAL;
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
if (v_len < size) {
|
|
wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);
|
|
if (!wbuf) {
|