Dan CarpenterandGreg Kroah-Hartman 82f59d64e6 ksmbd: fix integer overflows on 32 bit systems ...

commit aab98e2dbd upstream.

On 32bit systems the addition operations in ipc_msg_alloc() can
potentially overflow leading to memory corruption.
Add bounds checking using KSMBD_IPC_MAX_PAYLOAD to avoid overflow.

Fixes: 0626e6641f ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-02-17 09:40:17 +01:00

..

mgmt

ksmbd: fix racy issue from session lookup and expire

2024-12-19 18:11:21 +01:00

asn1.c

…

asn1.h

…

auth.c

ksmbd: fix racy issue from session lookup and expire

2024-12-19 18:11:21 +01:00

auth.h

…

connection.c

ksmbd: fix broken transfers when exceeding max simultaneous operations

2024-12-27 13:58:48 +01:00

connection.h

ksmbd: fix broken transfers when exceeding max simultaneous operations

2024-12-27 13:58:48 +01:00

crypto_ctx.c

…

crypto_ctx.h

…

glob.h

…

Kconfig

…

ksmbd_netlink.h

…

ksmbd_spnego_negtokeninit.asn1

…

ksmbd_spnego_negtokentarg.asn1

…

ksmbd_work.c

…

ksmbd_work.h

…

Makefile

…

misc.c

…

misc.h

…

ndr.c

…

ndr.h

…

nterr.h

…

ntlmssp.h

…

oplock.c

ksmbd: add refcnt to ksmbd_conn struct

2024-10-10 11:57:39 +02:00

oplock.h

…

server.c

ksmbd: fix broken transfers when exceeding max simultaneous operations

2024-12-27 13:58:48 +01:00

server.h

ksmbd: fix broken transfers when exceeding max simultaneous operations

2024-12-27 13:58:48 +01:00

smb2misc.c

…

smb2ops.c

…

smb2pdu.c

ksmbd: Implement new SMB3 POSIX type

2025-01-17 13:36:18 +01:00

smb2pdu.h

ksmbd: Implement new SMB3 POSIX type

2025-01-17 13:36:18 +01:00

smb_common.c

smb: server: Fix building with GCC 15

2025-01-02 10:32:05 +01:00

smb_common.h

ksmbd: check outstanding simultaneous SMB operations

2024-11-14 13:19:35 +01:00

smbacl.c

…

smbacl.h

…

smbfsctl.h

…

smbstatus.h

…

transport_ipc.c

ksmbd: fix integer overflows on 32 bit systems

2025-02-17 09:40:17 +01:00

transport_ipc.h

…

transport_rdma.c

…

transport_rdma.h

…

transport_tcp.c

ksmbd: Unlock on in ksmbd_tcp_set_interfaces()

2024-09-12 11:11:25 +02:00

transport_tcp.h

…

unicode.c

…

unicode.h

…

vfs_cache.c

ksmbd: add refcnt to ksmbd_conn struct

2024-10-10 11:57:39 +02:00

vfs_cache.h

…

vfs.c

ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked

2025-01-17 13:36:16 +01:00

vfs.h

ksmbd: retry iterate_dir in smb2_query_dir

2025-01-09 13:32:04 +01:00

xattr.h

…