[PATCH v4 08/10] smb: client: fix underflow in is_valid_oplock_break() notify offset check

[Frank Sorenson <sorenson@redhat.com>]

The bounds check intended to validate data_offset against the received
frame length:

    if (data_offset > len - sizeof(struct file_notify_information))

suffers from an integer underflow if len is smaller than the size of the
file_notify_information structure. This allows a malicious or malformed
packet to bypass the check and construct pnotify using an invalid,
unchecked data_offset.

Fix this by explicitly checking that len is at least the size of
struct file_notify_information before evaluating the data_offset.

Fixes: 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
---
 fs/smb/client/smb1misc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/smb1misc.c b/fs/smb/client/smb1misc.c
index cdfbbff24b72..a39c9140ceca 100644
--- a/fs/smb/client/smb1misc.c
+++ b/fs/smb/client/smb1misc.c
@@ -86,7 +86,8 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
 		if (get_bcc(buf) > sizeof(struct file_notify_information)) {
 			data_offset = le32_to_cpu(pSMBr->DataOffset);
 
-			if (data_offset >
+			if (len < sizeof(struct file_notify_information) ||
+			    data_offset >
 			    len - sizeof(struct file_notify_information)) {
 				cifs_dbg(FYI, "Invalid data_offset %u\n",
 					 data_offset);
-- 
2.55.0