diff options
| author | Ratnaker Gautam <ratnaker.gautam@kuleuven.be> | 2026-10-18 00:49:33 +0200 |
|---|---|---|
| committer | Paulo Alcantara <pc@manguebit.org> | 2026-10-21 21:06:48 -0300 |
| commit | 8fc9af68c57156ff64769f30e831553cd03b3000 (patch) | |
| tree | af5e6f62a48bfbe4852fb431a2aaaff2d0547983 /tools/perf/scripts/python/bin | |
| parent | 2c455ddca7827ad8fa3a64fdbf5a60efb928b46a (diff) | |
| download | linux-8fc9af68c57156ff64769f30e831553cd03b3000.tar.gz linux-8fc9af68c57156ff64769f30e831553cd03b3000.zip | |
smb: client: bound POSIX lock data area by response length
CIFSSMBPosixLock() receives a TRANS2 response whose server-provided
DataOffset and DataCount are not required by validate_t2() to describe an
interval inside the response. A server can therefore make the client read a
cifs_posix_lock beyond the response buffer and return those kernel bytes
through F_GETLK.
Use smbCalcSize() to obtain the full response length after any multipart
TRANS2 reassembly, then reject data areas that extend past it before
dereferencing them.
Fixes: fc94cdb94462 ("[CIFS] Fix new POSIX Locking for setting lock_type correctly on unlock")
Reported-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Diffstat (limited to 'tools/perf/scripts/python/bin')
0 files changed, 0 insertions, 0 deletions