Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfb29d69 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

cifs: read overflow in is_valid_oplock_break() 



[ Upstream commit 097f5863b1a0c9901f180bbd56ae7d630655faaa ]

We need to verify that the "data_offset" is within bounds.

Reported-by: default avatarDr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Reviewed-by: default avatarAurelien Aptel <aaptel@suse.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7d60f98c

fs/cifs/misc.c

+8 −0
Original line number Diff line number Diff line
@@ -398,9 +398,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) 
			(struct smb_com_transaction_change_notify_rsp *)buf;

		struct file_notify_information *pnotify;

		__u32 data_offset = 0;

		size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length);



		if (get_bcc(buf) > sizeof(struct file_notify_information)) {

			data_offset = le32_to_cpu(pSMBr->DataOffset);



			if (data_offset >

			    len - sizeof(struct file_notify_information)) {

				cifs_dbg(FYI, "invalid data_offset %u\n",

					 data_offset);

				return true;

			}

			pnotify = (struct file_notify_information *)

				((char *)&pSMBr->hdr.Protocol + data_offset);

			cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n",