diff options
| author | Qianchang Zhao <pioooooooooip@gmail.com> | 2025-10-22 15:27:47 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-29 14:07:06 +0100 |
| commit | 2dc125f5da134c0915a840b62565c60a595673dd (patch) | |
| tree | 85ef10efc0828adb91e382c77f1ba77cf44185e0 /ipc | |
| parent | 2ae71c3770c39293b3d0ef540860026d9f5f0ee0 (diff) | |
| download | linux-2dc125f5da134c0915a840b62565c60a595673dd.tar.gz linux-2dc125f5da134c0915a840b62565c60a595673dd.tar.bz2 linux-2dc125f5da134c0915a840b62565c60a595673dd.zip | |
ksmbd: transport_ipc: validate payload size before reading handle
commit 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0 upstream.
handle_response() dereferences the payload as a 4-byte handle without
verifying that the declared payload size is at least 4 bytes. A malformed
or truncated message from ksmbd.mountd can lead to a 4-byte read past the
declared payload size. Validate the size before dereferencing.
This is a minimal fix to guard the initial handle read.
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'ipc')
0 files changed, 0 insertions, 0 deletions