diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2022-08-09 05:15:13 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2022-08-09 05:15:13 +0200 |
| commit | eb555cb5b794f4e12a9897f3d46d5a72104cd4a7 (patch) | |
| tree | ab35899895fd36207fab74cf323c93e2ca41d463 /fs/ksmbd/vfs.c | |
| parent | Merge tag 'pull-work.iov_iter-rebased' of git://git.kernel.org/pub/scm/linux/... (diff) | |
| parent | ksmbd: fix heap-based overflow in set_ntacl_dacl() (diff) | |
| download | linux-eb555cb5b794f4e12a9897f3d46d5a72104cd4a7.tar.xz linux-eb555cb5b794f4e12a9897f3d46d5a72104cd4a7.zip | |
Merge tag '5.20-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd
Pull ksmbd updates from Steve French:
- fixes for memory access bugs (out of bounds access, oops, leak)
- multichannel fixes
- session disconnect performance improvement, and session register
improvement
- cleanup
* tag '5.20-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: fix heap-based overflow in set_ntacl_dacl()
ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT
ksmbd: prevent out of bound read for SMB2_WRITE
ksmbd: fix use-after-free bug in smb2_tree_disconect
ksmbd: fix memory leak in smb2_handle_negotiate
ksmbd: fix racy issue while destroying session on multichannel
ksmbd: use wait_event instead of schedule_timeout()
ksmbd: fix kernel oops from idr_remove()
ksmbd: add channel rwlock
ksmbd: replace sessions list in connection with xarray
MAINTAINERS: ksmbd: add entry for documentation
ksmbd: remove unused ksmbd_share_configs_cleanup function
Diffstat (limited to 'fs/ksmbd/vfs.c')
| -rw-r--r-- | fs/ksmbd/vfs.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/fs/ksmbd/vfs.c b/fs/ksmbd/vfs.c index 7c849024999f..78d01033604c 100644 --- a/fs/ksmbd/vfs.c +++ b/fs/ksmbd/vfs.c @@ -481,12 +481,11 @@ int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp, char *buf, size_t count, loff_t *pos, bool sync, ssize_t *written) { - struct ksmbd_session *sess = work->sess; struct file *filp; loff_t offset = *pos; int err = 0; - if (sess->conn->connection_type) { + if (work->conn->connection_type) { if (!(fp->daccess & FILE_WRITE_DATA_LE)) { pr_err("no right to write(%pd)\n", fp->filp->f_path.dentry); @@ -1540,6 +1539,11 @@ int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn, } *pntsd = acl.sd_buf; + if (acl.sd_size < sizeof(struct smb_ntsd)) { + pr_err("sd size is invalid\n"); + goto out_free; + } + (*pntsd)->osidoffset = cpu_to_le32(le32_to_cpu((*pntsd)->osidoffset) - NDR_NTSD_OFFSETOF); (*pntsd)->gsidoffset = cpu_to_le32(le32_to_cpu((*pntsd)->gsidoffset) - |