diff options
| author | Shirish Pargaonkar <shirishpargaonkar@gmail.com> | 2018-06-04 06:46:22 -0500 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2018-06-04 19:19:24 -0500 |
| commit | ee25c6dd7b05113783ce1f4fab6b30fc00d29b8d (patch) | |
| tree | 0d9f36330c53ae05ffdd630819e298719dcfbbcb /fs/cifs/smb2pdu.c | |
| parent | 57f933ce9fba4a1cecb6e34ffafe841d093493cb (diff) | |
cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class
Validate_buf () function checks for an expected minimum sized response
passed to query_info() function.
For security information, the size of a security descriptor can be
smaller (one subauthority, no ACEs) than the size of the structure
that defines FileInfoClass of FileAllInformation.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199725
Cc: <stable@vger.kernel.org>
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Reviewed-by: Noah Morrison <noah.morrison@rubrik.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/cifs/smb2pdu.c')
| -rw-r--r-- | fs/cifs/smb2pdu.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 281fbc1dc720..e7a40703028f 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2492,8 +2492,7 @@ SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, return query_info(xid, tcon, persistent_fid, volatile_fid, 0, SMB2_O_INFO_SECURITY, additional_info, - SMB2_MAX_BUFFER_SIZE, - sizeof(struct smb2_file_all_info), data, plen); + SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); } int |