ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
commit 5282491f upstream. If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done. Cc: stable@vger.kernel.org Fixes: 2ea086e3 ("ksmbd: add buffer validation for smb direct") Reviewed-by:Stefan Metzmacher <metze@samba.org> Reported-by:
Luigino Camastra, Aisle Research <luigino.camastra@aisle.com> Signed-off-by:
Namjae Jeon <linkinjeon@kernel.org> Signed-off-by:
Steve French <stfrench@microsoft.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Loading