* [PATCH] fs/smb/server: fix off-by-one in ksmbd_nl_policy
@ 2024-01-23 20:50 Kyle Zeng
2024-01-24 1:37 ` Namjae Jeon
0 siblings, 1 reply; 2+ messages in thread
From: Kyle Zeng @ 2024-01-23 20:50 UTC (permalink / raw)
To: linkinjeon, sfrench, senozhatsky, tom, linux-cifs
The size of the policy array should be one larger than genl_family.maxattr, or it
will lead to an off-by-one read during nlattr parsing because
gennl_family.maxattr should be the *largest expected* value
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
---
fs/smb/server/transport_ipc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
index b49d47bdafc..185db4d7f2b 100644
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -74,7 +74,7 @@ static int handle_unsupported_event(struct sk_buff *skb, struct genl_info *info)
static int handle_generic_event(struct sk_buff *skb, struct genl_info *info);
static int ksmbd_ipc_heartbeat_request(void);
-static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX] = {
+static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX + 1] = {
[KSMBD_EVENT_UNSPEC] = {
.len = 0,
},
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] fs/smb/server: fix off-by-one in ksmbd_nl_policy
2024-01-23 20:50 [PATCH] fs/smb/server: fix off-by-one in ksmbd_nl_policy Kyle Zeng
@ 2024-01-24 1:37 ` Namjae Jeon
0 siblings, 0 replies; 2+ messages in thread
From: Namjae Jeon @ 2024-01-24 1:37 UTC (permalink / raw)
To: Kyle Zeng; +Cc: sfrench, senozhatsky, tom, linux-cifs, Lin Ma
2024-01-24 5:50 GMT+09:00, Kyle Zeng <zengyhkyle@gmail.com>:
> The size of the policy array should be one larger than genl_family.maxattr,
> or it
> will lead to an off-by-one read during nlattr parsing because
> gennl_family.maxattr should be the *largest expected* value
>
> Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
> ---
> fs/smb/server/transport_ipc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
> index b49d47bdafc..185db4d7f2b 100644
> --- a/fs/smb/server/transport_ipc.c
> +++ b/fs/smb/server/transport_ipc.c
> @@ -74,7 +74,7 @@ static int handle_unsupported_event(struct sk_buff *skb,
> struct genl_info *info)
> static int handle_generic_event(struct sk_buff *skb, struct genl_info
> *info);
> static int ksmbd_ipc_heartbeat_request(void);
>
> -static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX] = {
> +static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX + 1] = {'
Have you checked the following patch ? And can this patch replace the
patch below?
https://lore.kernel.org/lkml/20240121073506.84528-1-linma@zju.edu.cn/t/
Thanks.
> [KSMBD_EVENT_UNSPEC] = {
> .len = 0,
> },
> --
> 2.34.1
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-01-24 1:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-01-23 20:50 [PATCH] fs/smb/server: fix off-by-one in ksmbd_nl_policy Kyle Zeng
2024-01-24 1:37 ` Namjae Jeon
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.