Skip to content

Commit 0ca6df4

Browse files
nszeteiSteve French
authored andcommitted
ksmbd: prevent out-of-bounds stream writes by validating *pos
ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). If *pos was greater than or equal to v_len, this could lead to an out-of-bounds memory write. This patch adds a check to ensure *pos is less than v_len before proceeding. If the condition fails, -EINVAL is returned. Cc: stable@vger.kernel.org Signed-off-by: Norbert Szetei <norbert@doyensec.com> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
1 parent eb4447b commit 0ca6df4

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

fs/smb/server/vfs.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,13 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
426426
goto out;
427427
}
428428

429+
if (v_len <= *pos) {
430+
pr_err("stream write position %lld is out of bounds (stream length: %zd)\n",
431+
*pos, v_len);
432+
err = -EINVAL;
433+
goto out;
434+
}
435+
429436
if (v_len < size) {
430437
wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);
431438
if (!wbuf) {

0 commit comments

Comments
 (0)