shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 19:08:57 +09:00
Code Issues Packages Projects Releases Wiki Activity

cifs: Validate content of WSL reparse point buffers

Browse Source 
[ Upstream commit 1f48660667efb97c3cf70485c7e1977af718b48b ]

WSL socket, fifo, char and block devices have empty reparse buffer.
Validate the length of the reparse buffer.

Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: cad3fc0a4c8c ("cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pali Rohár
2024-09-21 01:29:33 +02:00
committed by Greg Kroah-Hartman
parent 6c13fcb7cf
commit 474c08712d
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
fs/smb/client/reparse.c
View File

@@ -651,6 +651,11 @@ int parse_reparse_point(struct reparse_data_buffer *buf,
case IO_REPARSE_TAG_LX_FIFO:
case IO_REPARSE_TAG_LX_CHR:
case IO_REPARSE_TAG_LX_BLK:
if (le16_to_cpu(buf->ReparseDataLength) != 0) {
cifs_dbg(VFS, "srv returned malformed buffer for reparse point: 0x%08x\n",
le32_to_cpu(buf->ReparseTag));
return -EIO;
}
break;
default:
cifs_tcon_dbg(VFS | ONCE, "unhandled reparse tag: 0x%08x\n",