Commit f65289a8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'v6.13-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd 

Pull smb server fixes from Steve French:

 - Three fixes for potential out of bound accesses in read and write
   paths (e.g. when alternate data streams enabled)

 - GCC 15 build fix

* tag 'v6.13-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: align aux_payload_buf to avoid OOB reads in cryptographic operations
  ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
  ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
  smb: server: Fix building with GCC 15
parents 896d8946 06a02544

fs/smb/server/smb2pdu.c

+7 −1
Original line number Diff line number Diff line
@@ -6663,6 +6663,10 @@ int smb2_read(struct ksmbd_work *work) 
	}



	offset = le64_to_cpu(req->Offset);

	if (offset < 0) {

		err = -EINVAL;

		goto out;

	}

	length = le32_to_cpu(req->Length);

	mincount = le32_to_cpu(req->MinimumCount);
@@ -6676,7 +6680,7 @@ int smb2_read(struct ksmbd_work *work) 
	ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n",

		    fp->filp, offset, length);



	aux_payload_buf = kvzalloc(length, KSMBD_DEFAULT_GFP);

	aux_payload_buf = kvzalloc(ALIGN(length, 8), KSMBD_DEFAULT_GFP);

	if (!aux_payload_buf) {

		err = -ENOMEM;

		goto out;
@@ -6878,6 +6882,8 @@ int smb2_write(struct ksmbd_work *work) 
	}



	offset = le64_to_cpu(req->Offset);

	if (offset < 0)

		return -EINVAL;

	length = le32_to_cpu(req->Length);



	if (req->Channel == SMB2_CHANNEL_RDMA_V1 ||

fs/smb/server/smb_common.c

+2 −2
Original line number Diff line number Diff line
@@ -18,8 +18,8 @@ 
#include "mgmt/share_config.h"



/*for shortname implementation */

static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";

#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1)

static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";

#define MANGLE_BASE (strlen(basechars) - 1)

#define MAGIC_CHAR '~'

#define PERIOD '.'

#define mangle(V) ((char)(basechars[(V) % MANGLE_BASE]))