From: Marios Makassikis <mmakassikis@freebox.fr>
Date: Thu, 6 May 2021 02:40:02 +0000 (+0900)
Subject: cifsd: Update out_buf_len in smb2_populate_readdir_entry()
X-Git-Tag: v5.15~454^2~26
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e7735c854880084a6d97e60465f19daa42842eff;p=platform%2Fkernel%2Flinux-starfive.git

cifsd: Update out_buf_len in smb2_populate_readdir_entry()

When processing a SMB2 QUERY_DIRECTORY request,
smb2_populate_readdir_entry() is called first to fill the dot/dotdot
entries. This moves the d_info->wptr pointer but out_buf_len remains
unchanged. As a result, reserve_populate_dentry() may end up writing
past the end of the buffer since the bounds checking is done on
invalid values.

Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
---

diff --git a/fs/cifsd/smb2pdu.c b/fs/cifsd/smb2pdu.c
index fec3853..54df9a3 100644
--- a/fs/cifsd/smb2pdu.c
+++ b/fs/cifsd/smb2pdu.c
@@ -3333,6 +3333,7 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
 
 	d_info->last_entry_offset = d_info->data_count;
 	d_info->data_count += next_entry_offset;
+	d_info->out_buf_len -= next_entry_offset;
 	d_info->wptr += next_entry_offset;
 	kfree(conv_name);