diff options
| author | Bartlomiej Zolnierkiewicz <[email protected]> | 2018-09-26 15:54:31 +0200 |
|---|---|---|
| committer | Bartlomiej Zolnierkiewicz <[email protected]> | 2018-09-26 15:54:31 +0200 |
| commit | aaccf3c97418f169afdbb5855e9cbcbda34e90fd (patch) | |
| tree | 5d4207e67958bdbc23288cf30178692f5534e1a0 /fs/cifs/misc.c | |
| parent | f39684524b391c5a7ed0ac44db4fec3357af1c5d (diff) | |
| parent | 6bf4ca7fbc85d80446ac01c0d1d77db4d91a6d84 (diff) | |
Merge tag 'v4.19-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into fbdev-for-next
Sync with upstream (which now contains fbdev-v4.19 changes) to
prepare a base for fbdev-v4.20 changes.
Diffstat (limited to 'fs/cifs/misc.c')
| -rw-r--r-- | fs/cifs/misc.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 53e8362cbc4a..6926685e513c 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -122,9 +122,7 @@ tconInfoAlloc(void) mutex_init(&ret_buf->crfid.fid_mutex); ret_buf->crfid.fid = kzalloc(sizeof(struct cifs_fid), GFP_KERNEL); -#ifdef CONFIG_CIFS_STATS spin_lock_init(&ret_buf->stat_lock); -#endif } return ret_buf; } @@ -404,9 +402,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) (struct smb_com_transaction_change_notify_rsp *)buf; struct file_notify_information *pnotify; __u32 data_offset = 0; + size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length); + if (get_bcc(buf) > sizeof(struct file_notify_information)) { data_offset = le32_to_cpu(pSMBr->DataOffset); + if (data_offset > + len - sizeof(struct file_notify_information)) { + cifs_dbg(FYI, "invalid data_offset %u\n", + data_offset); + return true; + } pnotify = (struct file_notify_information *) ((char *)&pSMBr->hdr.Protocol + data_offset); cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n", |