diff options
| author | Norbert Szetei <norbert@doyensec.com> | 2024-11-30 16:56:14 +0100 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-12-04 19:45:28 -0600 |
| commit | 06a025448b572c3bd78dd23a31488a0907cd9512 (patch) | |
| tree | 8eeeb25b31c175a126a46b3a048522d1aa1fedcb /fs | |
| parent | 313dab082289e460391c82d855430ec8a28ddf81 (diff) | |
ksmbd: align aux_payload_buf to avoid OOB reads in cryptographic operations
The aux_payload_buf allocation in SMB2 read is performed without ensuring
alignment, which could result in out-of-bounds (OOB) reads during
cryptographic operations such as crypto_xor or ghash. This patch aligns
the allocation of aux_payload_buf to prevent these issues.
(Note that to add this patch to stable would require modifications due
to recent patch "ksmbd: use __GFP_RETRY_MAYFAIL")
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 23879555880f..4f539eeadbb0 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -6680,7 +6680,7 @@ int smb2_read(struct ksmbd_work *work) ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n", fp->filp, offset, length); - aux_payload_buf = kvzalloc(length, KSMBD_DEFAULT_GFP); + aux_payload_buf = kvzalloc(ALIGN(length, 8), KSMBD_DEFAULT_GFP); if (!aux_payload_buf) { err = -ENOMEM; goto out; |