From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Steven French <Steven.French@microsoft.com>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 3.18 11/13] cifs: read overflow in is_valid_oplock_break()
Date: Mon, 1 Oct 2018 00:41:52 +0000 [thread overview]
Message-ID: <20181001004139.147341-11-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20181001004139.147341-1-alexander.levin@microsoft.com>
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 097f5863b1a0c9901f180bbd56ae7d630655faaa ]
We need to verify that the "data_offset" is within bounds.
Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
fs/cifs/misc.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index eedbc34e19db..c8662e212afc 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -405,9 +405,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
(struct smb_com_transaction_change_notify_rsp *)buf;
struct file_notify_information *pnotify;
__u32 data_offset = 0;
+ size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length);
+
if (get_bcc(buf) > sizeof(struct file_notify_information)) {
data_offset = le32_to_cpu(pSMBr->DataOffset);
+ if (data_offset >
+ len - sizeof(struct file_notify_information)) {
+ cifs_dbg(FYI, "invalid data_offset %u\n",
+ data_offset);
+ return true;
+ }
pnotify = (struct file_notify_information *)
((char *)&pSMBr->hdr.Protocol + data_offset);
cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n",
--
2.17.1
next prev parent reply other threads:[~2018-10-01 0:41 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-01 0:41 [PATCH AUTOSEL 3.18 01/13] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 02/13] pinctrl: msm: Really mask level interrupts to prevent latching Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 03/13] RDMA/ucma: check fd type in ucma_migrate_id() Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 04/13] USB: yurex: Check for truncation in yurex_read() Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 05/13] fs/cifs: suppress a string overflow warning Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 06/13] dm thin metadata: try to avoid ever aborting transactions Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 07/13] arch/hexagon: fix kernel/dma.c build warning Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 08/13] hexagon: modify ffs() and fls() to return int Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 09/13] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 10/13] s390/qeth: don't dump past end of unknown HW header Sasha Levin
2018-10-01 0:41 ` Sasha Levin [this message]
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 12/13] xen/manage: don't complain about an empty value in control/sysrq node Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 13/13] xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181001004139.147341-11-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=Steven.French@microsoft.com \
--cc=dan.carpenter@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).