Commit 1f4bbedd authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: fix stream write failure 



If there is no stream data in file, v_len is zero.
So, If position(*pos) is zero, stream write will fail
due to stream write position validation check.
This patch reorganize stream write position validation.

Fixes: 0ca6df4f ("ksmbd: prevent out-of-bounds stream writes by validating *pos")
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent a5806cd5

fs/smb/server/vfs.c

+6 −8
Original line number Diff line number Diff line
@@ -409,10 +409,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, 
	ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n",

		    *pos, count);



	if (*pos >= XATTR_SIZE_MAX) {

		pr_err("stream write position %lld is out of bounds\n",	*pos);

		return -EINVAL;

	}



	size = *pos + count;

	if (size > XATTR_SIZE_MAX) {

		size = XATTR_SIZE_MAX;

		count = (*pos + count) - XATTR_SIZE_MAX;

		count = XATTR_SIZE_MAX - *pos;

	}



	v_len = ksmbd_vfs_getcasexattr(idmap,
@@ -426,13 +431,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, 
		goto out;

	}



	if (v_len <= *pos) {

		pr_err("stream write position %lld is out of bounds (stream length: %zd)\n",

				*pos, v_len);

		err = -EINVAL;

		goto out;

	}



	if (v_len < size) {

		wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);

		if (!wbuf) {