diff options
| author | Bryam Vargas <hexlabsecurity@proton.me> | 2026-07-28 13:06:13 -0500 |
|---|---|---|
| committer | Paulo Alcantara <pc@manguebit.org> | 2026-08-24 17:08:53 -0300 |
| commit | ba22f575de9deeae4ae0859ca4315a7698226237 (patch) | |
| tree | 5081a70f2020de24997ded8c17406bc5506d560b | |
| parent | b96db32fed8dfb2478d7c208f89bf383beed1535 (diff) | |
| download | linux-ba22f575de9deeae4ae0859ca4315a7698226237.tar.gz linux-ba22f575de9deeae4ae0859ca4315a7698226237.zip | |
smb: client: restore the data_offset bound in is_valid_oplock_break()
Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
changed the quantity this bound is measured against. It used to be
srv->total_read minus the 4-byte RFC1002 preamble that total_read then
included, so it was the SMB message length. The same commit stopped
counting the preamble, and the mechanical substitution to
srv->total_read - srv->pdu_size left an expression that is identically
zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly
pdu_length - MID_HEADER_SIZE() more, adding both to total_read.
len is therefore 0, the subtraction below it wraps, and no __u32
DataOffset can exceed the result, so the check from commit 097f5863b1a0
("cifs: read overflow in is_valid_oplock_break()") no longer rejects
anything. Use total_read, which is now the message length on its own.
Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
Cc: stable@kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
| -rw-r--r-- | fs/smb/client/smb1misc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/smb/client/smb1misc.c b/fs/smb/client/smb1misc.c index ba56023010d8..cdfbbff24b72 100644 --- a/fs/smb/client/smb1misc.c +++ b/fs/smb/client/smb1misc.c @@ -80,7 +80,8 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) (struct smb_com_transaction_change_notify_rsp *)buf; struct file_notify_information *pnotify; __u32 data_offset = 0; - size_t len = srv->total_read - srv->pdu_size; + /* total_read excludes the RFC1002 preamble */ + size_t len = srv->total_read; if (get_bcc(buf) > sizeof(struct file_notify_information)) { data_offset = le32_to_cpu(pSMBr->DataOffset); |