diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2024-08-20 22:07:38 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-08-22 09:52:00 -0500 |
| commit | ce61b605a00502c59311d0a4b1f58d62b48272d0 (patch) | |
| tree | e341b78f24cbf90f133291be99bfefc97d7c7eb7 /fs/smb/server | |
| parent | b311c1b497e51a628aa89e7cb954481e5f9dced2 (diff) | |
ksmbd: the buffer of smb2 query dir response has at least 1 byte
When STATUS_NO_MORE_FILES status is set to smb2 query dir response,
->StructureSize is set to 9, which mean buffer has 1 byte.
This issue occurs because ->Buffer[1] in smb2_query_directory_rsp to
flex-array.
Fixes: eb3e28c1e89b ("smb3: Replace smb2pdu 1-element arrays with flex-arrays")
Cc: stable@vger.kernel.org # v6.1+
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/server')
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 0bc9edf22ba4..e9204180919e 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -4409,7 +4409,8 @@ int smb2_query_dir(struct ksmbd_work *work) rsp->OutputBufferLength = cpu_to_le32(0); rsp->Buffer[0] = 0; rc = ksmbd_iov_pin_rsp(work, (void *)rsp, - sizeof(struct smb2_query_directory_rsp)); + offsetof(struct smb2_query_directory_rsp, Buffer) + + 1); if (rc) goto err_out; } else { |