sieni
/
linux
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/fs/smb/client
History
Henrique Carvalho fa2fd0b10f smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range 
struct copychunk_ioctl_req::ChunkCount is annotated with
__counted_by_le() as the number of elements in Chunks[].

smb2_copychunk_range reuses ChunkCount to store the number of chunks
sent in the current iteration. If a later iteration populates more
chunks than a previous one, the stale smaller value trips UBSAN.

Set ChunkCount to chunk_count (allocated capacity) before populating
Chunks[].

Fixes: cc26f593dc ("smb: move copychunk definitions to common/smb2pdu.h")
Link: https://lore.kernel.org/linux-cifs/CAH2r5ms9AWLy8WZ04Cpq5XOeVK64tcrUQ6__iMW+yk1VPzo1BA@mail.gmail.com
Tested-by: Youling Tang <tangyouling@kylinos.cn>
Acked-by:  ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
 		2025-12-30 09:17:41 -06:00
..
compress move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
Kconfig smb: client: Remove obsolete crypto_shash allocations 2025-10-15 22:10:28 -05:00
Makefile cifs: Move the SMB1 transport code out of transport.c 2025-08-06 12:01:54 -05:00
asn1.c smb3: add support for IAKerb 2025-01-31 12:51:44 -06:00
cached_dir.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
cached_dir.h smb: client: remove cfids_invalidation_worker 2025-10-09 11:18:09 -05:00
cifs_debug.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
cifs_debug.h cifs: Remove the RFC1002 header from smb_hdr 2025-12-05 17:09:32 -06:00
cifs_fs_sb.h smb:client: smb: client: Add reverse mapping from tcon to superblocks 2025-03-31 21:12:31 -05:00
cifs_ioctl.h smb: minor fix to use SMB2_NTLMV2_SESSKEY_SIZE for auth_key size 2025-06-21 11:03:25 -05:00
cifs_spnego.c smb: client: Add tracepoint for krb5 auth 2025-12-05 17:40:42 -06:00
cifs_spnego.h cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
cifs_spnego_negtokeninit.asn1
…
cifs_swn.c smb: client: Return directly after a failed genlmsg_new() in cifs_swn_send_register_message() 2025-10-07 14:28:16 -05:00
cifs_swn.h
…
cifs_unicode.c cifs: prevent NULL pointer dereference in UTF16 conversion 2025-09-04 11:43:31 -05:00
cifs_unicode.h cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
cifsacl.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
cifsacl.h smb: client: Correct typos in multiple comments across various files 2024-10-02 17:52:24 -05:00
cifsencrypt.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
cifsfs.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
cifsfs.h cifs: update internal module version number 2025-12-16 17:43:02 -06:00
cifsglob.h smb: client: relax session and tcon reconnect attempts 2025-12-05 17:40:33 -06:00
cifspdu.h smb: move some SMB1 definitions into common/smb1pdu.h 2025-12-16 17:43:01 -06:00
cifsproto.h cifs: Remove dead function prototypes 2025-12-05 17:54:09 -06:00
cifsroot.c
…
cifssmb.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
cifstransport.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
compress.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
compress.h cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
connect.c smb: client: improve error message when creating SMB session 2025-12-05 17:40:38 -06:00
dfs.c smb: client: don't trust DFSREF_STORAGE_SERVER bit 2025-02-05 21:09:00 -06:00
dfs.h smb: client: get rid of kstrdup() in get_ses_refpath() 2025-02-05 21:09:07 -06:00
dfs_cache.c smb: client: handle lack of IPC in dfs_cache_refresh() 2025-10-29 20:13:05 -05:00
dfs_cache.h smb: client: ensure to try all targets when finding nested links 2023-08-20 16:05:50 -05:00
dir.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
dns_resolve.c smb: client: provide dns_resolve_{unc,name} helpers 2025-01-19 19:34:00 -06:00
dns_resolve.h cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
export.c exportfs: make ->encode_fh() a mandatory method for NFS export 2023-10-28 16:15:15 +02:00
file.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
fs_context.c cifs: Fix memory and information leak in smb3_reconfigure() 2025-12-24 11:07:15 -06:00
fs_context.h cifs: client: enforce consistent handling of multichannel and max_channels 2025-12-03 23:32:44 -06:00
fscache.c cifs: Remove some code that's no longer used, part 1 2024-05-01 18:08:21 +01:00
fscache.h cifs: Remove some code that's no longer used, part 1 2024-05-01 18:08:21 +01:00
inode.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
ioctl.c smb3 client: add missing tracepoint for unsupported ioctls 2025-12-30 09:16:45 -06:00
link.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
misc.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
namespace.c 13 smb3/cifs client fixes 2025-06-03 16:04:29 -07:00
netlink.c
…
netlink.h
…
netmisc.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
nterr.c smb/client: add 4 NT error code definitions 2025-12-09 21:21:42 -06:00
nterr.h smb/client: add parentheses to NT error code definitions containing bitwise OR operator 2025-12-09 21:22:34 -06:00
ntlmssp.h smb: fix some warnings reported by scripts/checkpatch.pl 2025-11-30 21:11:45 -06:00
readdir.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
reparse.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
reparse.h smb: do some cleanups 2025-11-30 21:11:45 -06:00
rfc1002pdu.h smb: fix some warnings reported by scripts/checkpatch.pl 2025-11-30 21:11:45 -06:00
sess.c cifs: client: allow changing multichannel mount options on remount 2025-12-05 17:14:14 -06:00
smb1ops.c cifs: Remove the server pointer from smb_message 2025-12-05 17:10:48 -06:00
smb2file.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
smb2glob.h smb: client: fix data loss due to broken rename(2) 2025-09-09 18:39:58 -05:00
smb2inode.c cifs: Do some preparation prior to organising the function declarations 2025-12-05 17:11:55 -06:00
smb2maperror.c smb/client: update some SMB2 status strings 2025-12-07 11:46:19 -06:00
smb2misc.c cifs: Remove the RFC1002 header from smb_hdr 2025-12-05 17:09:32 -06:00
smb2ops.c smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range 2025-12-30 09:17:41 -06:00
smb2pdu.c smb: client: Add tracepoint for krb5 auth 2025-12-05 17:40:42 -06:00
smb2pdu.h smb: move some duplicate struct definitions to common/fscc.h 2025-11-30 21:11:45 -06:00
smb2proto.h cifs: Remove dead function prototypes 2025-12-05 17:54:09 -06:00
smb2transport.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
smbdirect.c smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() 2025-11-30 21:11:45 -06:00
smbdirect.h smb: client: change smbd_deregister_mr() to return void 2025-10-13 08:26:22 -05:00
smbencrypt.c smb: client: delete "true", "false" defines 2024-01-23 12:41:02 -06:00
smberr.h
…
trace.c smb: client: Add tracepoint for krb5 auth 2025-12-05 17:40:42 -06:00
trace.h smb3 client: add missing tracepoint for unsupported ioctls 2025-12-30 09:16:45 -06:00
transport.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00
unc.c
…
winucase.c
…
xattr.c cifs: Add a tracepoint to log EIO errors 2025-12-05 17:11:43 -06:00