diff options
| author | Namjae Jeon <[email protected]> | 2024-04-11 14:02:15 +0000 |
|---|---|---|
| committer | Steve French <[email protected]> | 2024-04-20 01:48:47 +0000 |
| commit | c119f4ede3fa90a9463f50831761c28f989bfb20 (patch) | |
| tree | 37ab574a68c2d9d7d2767ee674b1ebde287bc7a0 /drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | |
| parent | Linux 6.9-rc4 (diff) | |
| download | kernel-c119f4ede3fa90a9463f50831761c28f989bfb20.tar.gz kernel-c119f4ede3fa90a9463f50831761c28f989bfb20.zip | |
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size
validation could be skipped. if request size is smaller than
sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in
smb2_allocate_rsp_buf(). This patch allocate response buffer after
decrypting transform request. smb3_decrypt_req() will validate transform
request size and avoid slab-out-of-bound in smb2_allocate_rsp_buf().
Reported-by: Norbert Szetei <[email protected]>
Cc: [email protected]
Signed-off-by: Namjae Jeon <[email protected]>
Signed-off-by: Steve French <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c')
0 files changed, 0 insertions, 0 deletions