diff options
| author | Qianchang Zhao <pioooooooooip@gmail.com> | 2025-10-22 15:27:47 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-29 14:10:32 +0100 |
| commit | 867ffd9d67285612da3f0498ca618297f8e41f01 (patch) | |
| tree | 7e142ada3ffa8fc3566b1745268f3795c9b4ba0f | |
| parent | 1caa8b999d01a7e860a6fa6e639898cb29a50613 (diff) | |
| download | linux-867ffd9d67285612da3f0498ca618297f8e41f01.tar.gz linux-867ffd9d67285612da3f0498ca618297f8e41f01.tar.bz2 linux-867ffd9d67285612da3f0498ca618297f8e41f01.zip | |
ksmbd: transport_ipc: validate payload size before reading handle
commit 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0 upstream.
handle_response() dereferences the payload as a 4-byte handle without
verifying that the declared payload size is at least 4 bytes. A malformed
or truncated message from ksmbd.mountd can lead to a 4-byte read past the
declared payload size. Validate the size before dereferencing.
This is a minimal fix to guard the initial handle read.
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/smb/server/transport_ipc.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c index 46f87fd1ce1c..2c08cccfa680 100644 --- a/fs/smb/server/transport_ipc.c +++ b/fs/smb/server/transport_ipc.c @@ -263,10 +263,16 @@ static void ipc_msg_handle_free(int handle) static int handle_response(int type, void *payload, size_t sz) { - unsigned int handle = *(unsigned int *)payload; + unsigned int handle; struct ipc_msg_table_entry *entry; int ret = 0; + /* Prevent 4-byte read beyond declared payload size */ + if (sz < sizeof(unsigned int)) + return -EINVAL; + + handle = *(unsigned int *)payload; + ipc_update_last_active(); down_read(&ipc_msg_table_lock); hash_for_each_possible(ipc_msg_table, entry, ipc_table_hlist, handle) { |