diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2025-05-08 16:46:11 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2025-05-19 20:35:08 -0500 |
| commit | 1f4bbedd4e5a69b01cde2cc21d01151ab2d0884f (patch) | |
| tree | e406f678526e736fa173504be8136c15ec854418 | |
| parent | a5806cd506af5a7c19bcd596e4708b5c464bfd21 (diff) | |
ksmbd: fix stream write failure
If there is no stream data in file, v_len is zero.
So, If position(*pos) is zero, stream write will fail
due to stream write position validation check.
This patch reorganize stream write position validation.
Fixes: 0ca6df4f40cf ("ksmbd: prevent out-of-bounds stream writes by validating *pos")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/server/vfs.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c index 482eba0f4dc1..156ded9ac889 100644 --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -409,10 +409,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n", *pos, count); + if (*pos >= XATTR_SIZE_MAX) { + pr_err("stream write position %lld is out of bounds\n", *pos); + return -EINVAL; + } + size = *pos + count; if (size > XATTR_SIZE_MAX) { size = XATTR_SIZE_MAX; - count = (*pos + count) - XATTR_SIZE_MAX; + count = XATTR_SIZE_MAX - *pos; } v_len = ksmbd_vfs_getcasexattr(idmap, @@ -426,13 +431,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, goto out; } - if (v_len <= *pos) { - pr_err("stream write position %lld is out of bounds (stream length: %zd)\n", - *pos, v_len); - err = -EINVAL; - goto out; - } - if (v_len < size) { wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP); if (!wbuf) { |