From: Dan Carpenter Date: Thu, 6 Sep 2018 09:47:01 +0000 (+0300) Subject: cifs: read overflow in is_valid_oplock_break() X-Git-Tag: v4.19~179^2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=097f5863b1a0c9901f180bbd56ae7d630655faaa;p=platform%2Fkernel%2Flinux-rpi3.git cifs: read overflow in is_valid_oplock_break() We need to verify that the "data_offset" is within bounds. Reported-by: Dr Silvio Cesare of InfoSect Signed-off-by: Dan Carpenter Signed-off-by: Steve French Reviewed-by: Aurelien Aptel --- diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index dacb2c0..6926685 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -402,9 +402,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) (struct smb_com_transaction_change_notify_rsp *)buf; struct file_notify_information *pnotify; __u32 data_offset = 0; + size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length); + if (get_bcc(buf) > sizeof(struct file_notify_information)) { data_offset = le32_to_cpu(pSMBr->DataOffset); + if (data_offset > + len - sizeof(struct file_notify_information)) { + cifs_dbg(FYI, "invalid data_offset %u\n", + data_offset); + return true; + } pnotify = (struct file_notify_information *) ((char *)&pSMBr->hdr.Protocol + data_offset); cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n",