Re: [PATCH] fs/smb/server: fix off-by-one in ksmbd_nl_policy

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



2024-01-24 5:50 GMT+09:00, Kyle Zeng <zengyhkyle@xxxxxxxxx>:
> The size of the policy array should be one larger than genl_family.maxattr,
> or it
> will lead to an off-by-one read during nlattr parsing because
> gennl_family.maxattr should be the *largest expected* value
>
> Signed-off-by: Kyle Zeng <zengyhkyle@xxxxxxxxx>
> ---
>  fs/smb/server/transport_ipc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
> index b49d47bdafc..185db4d7f2b 100644
> --- a/fs/smb/server/transport_ipc.c
> +++ b/fs/smb/server/transport_ipc.c
> @@ -74,7 +74,7 @@ static int handle_unsupported_event(struct sk_buff *skb,
> struct genl_info *info)
>  static int handle_generic_event(struct sk_buff *skb, struct genl_info
> *info);
>  static int ksmbd_ipc_heartbeat_request(void);
>
> -static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX] = {
> +static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX + 1] = {'
Have you checked the following patch ? And can this patch replace the
patch below?

https://lore.kernel.org/lkml/20240121073506.84528-1-linma@xxxxxxxxxx/t/

Thanks.
>  	[KSMBD_EVENT_UNSPEC] = {
>  		.len = 0,
>  	},
> --
> 2.34.1
>
>




[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux