diff options
| author | Kuan-Ting Chen <[email protected]> | 2023-05-19 22:59:28 +0900 |
|---|---|---|
| committer | Steve French <[email protected]> | 2023-05-26 20:27:46 -0500 |
| commit | d738950f112c8f40f0515fe967db998e8235a175 (patch) | |
| tree | 606e4be7f029bedf2290046d8991fc68e53765d6 /drivers/fpga/fpga-bridge.c | |
| parent | 84c5aa47925a1f40d698b6a6a2bf67e99617433d (diff) | |
ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
Check request_buf length first to avoid out-of-bounds read by
req->DialectCount.
[ 3350.990282] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x35d7/0x3e60
[ 3350.990282] Read of size 2 at addr ffff88810ad61346 by task kworker/5:0/276
[ 3351.000406] Workqueue: ksmbd-io handle_ksmbd_work
[ 3351.003499] Call Trace:
[ 3351.006473] <TASK>
[ 3351.006473] dump_stack_lvl+0x8d/0xe0
[ 3351.006473] print_report+0xcc/0x620
[ 3351.006473] kasan_report+0x92/0xc0
[ 3351.006473] smb2_handle_negotiate+0x35d7/0x3e60
[ 3351.014760] ksmbd_smb_negotiate_common+0x7a7/0xf00
[ 3351.014760] handle_ksmbd_work+0x3f7/0x12d0
[ 3351.014760] process_one_work+0xa85/0x1780
Cc: [email protected]
Signed-off-by: Kuan-Ting Chen <[email protected]>
Acked-by: Namjae Jeon <[email protected]>
Signed-off-by: Steve French <[email protected]>
Diffstat (limited to 'drivers/fpga/fpga-bridge.c')
0 files changed, 0 insertions, 0 deletions