Commit 1f486606 authored by Pali Rohár's avatar Pali Rohár Committed by Steve French
Browse files

cifs: Validate content of WSL reparse point buffers 



WSL socket, fifo, char and block devices have empty reparse buffer.
Validate the length of the reparse buffer.

Signed-off-by: default avatarPali Rohár <pali@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent d3d797e3

fs/smb/client/reparse.c

+5 −0
Original line number Diff line number Diff line
@@ -719,6 +719,11 @@ int parse_reparse_point(struct reparse_data_buffer *buf, 
	case IO_REPARSE_TAG_LX_FIFO:

	case IO_REPARSE_TAG_LX_CHR:

	case IO_REPARSE_TAG_LX_BLK:

		if (le16_to_cpu(buf->ReparseDataLength) != 0) {

			cifs_dbg(VFS, "srv returned malformed buffer for reparse point: 0x%08x\n",

				 le32_to_cpu(buf->ReparseTag));

			return -EIO;

		}

		break;

	default:

		cifs_tcon_dbg(VFS | ONCE, "unhandled reparse tag: 0x%08x\n",