Commit bf21e29d authored by Norbert Szetei's avatar Norbert Szetei Committed by Steve French
Browse files

ksmbd: validate zero num_subauth before sub_auth is accessed 



Access psid->sub_auth[psid->num_subauth - 1] without checking
if num_subauth is non-zero leads to an out-of-bounds read.
This patch adds a validation step to ensure num_subauth != 0
before sub_auth is accessed.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarNorbert Szetei <norbert@doyensec.com>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent beff0bc9

fs/smb/server/smbacl.c

+5 −0
Original line number Diff line number Diff line
@@ -270,6 +270,11 @@ static int sid_to_id(struct mnt_idmap *idmap, 
		return -EIO;

	}



	if (psid->num_subauth == 0) {

		pr_err("%s: zero subauthorities!\n", __func__);

		return -EIO;

	}



	if (sidtype == SIDOWNER) {

		kuid_t uid;

		uid_t id;