michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
master
linux/fs/smb/client
History
Henrique Carvalho fa2fd0b10f smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range 
struct copychunk_ioctl_req::ChunkCount is annotated with
__counted_by_le() as the number of elements in Chunks[].

smb2_copychunk_range reuses ChunkCount to store the number of chunks
sent in the current iteration. If a later iteration populates more
chunks than a previous one, the stale smaller value trips UBSAN.

Set ChunkCount to chunk_count (allocated capacity) before populating
Chunks[].

Fixes: cc26f593dc ("smb: move copychunk definitions to common/smb2pdu.h")
Link: https://lore.kernel.org/linux-cifs/CAH2r5ms9AWLy8WZ04Cpq5XOeVK64tcrUQ6__iMW+yk1VPzo1BA@mail.gmail.com
Tested-by: Youling Tang <tangyouling@kylinos.cn>
Acked-by:  ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-30 09:17:41 -06:00
..
compress
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
asn1.c
smb3: add support for IAKerb
2025-01-31 12:51:44 -06:00
cached_dir.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
cached_dir.h
smb: client: remove cfids_invalidation_worker
2025-10-09 11:18:09 -05:00
cifs_debug.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
cifs_debug.h
cifs: Remove the RFC1002 header from smb_hdr
2025-12-05 17:09:32 -06:00
cifs_fs_sb.h
smb:client: smb: client: Add reverse mapping from tcon to superblocks
2025-03-31 21:12:31 -05:00
cifs_ioctl.h
smb: minor fix to use SMB2_NTLMV2_SESSKEY_SIZE for auth_key size
2025-06-21 11:03:25 -05:00
cifs_spnego_negtokeninit.asn1
…
cifs_spnego.c
smb: client: Add tracepoint for krb5 auth
2025-12-05 17:40:42 -06:00
cifs_spnego.h
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
cifs_swn.c
smb: client: Return directly after a failed genlmsg_new() in cifs_swn_send_register_message()
2025-10-07 14:28:16 -05:00
cifs_swn.h
…
cifs_unicode.c
cifs: prevent NULL pointer dereference in UTF16 conversion
2025-09-04 11:43:31 -05:00
cifs_unicode.h
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
cifsacl.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
cifsacl.h
smb: client: Correct typos in multiple comments across various files
2024-10-02 17:52:24 -05:00
cifsencrypt.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
cifsfs.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
cifsfs.h
cifs: update internal module version number
2025-12-16 17:43:02 -06:00
cifsglob.h
smb: client: relax session and tcon reconnect attempts
2025-12-05 17:40:33 -06:00
cifspdu.h
smb: move some SMB1 definitions into common/smb1pdu.h
2025-12-16 17:43:01 -06:00
cifsproto.h
cifs: Remove dead function prototypes
2025-12-05 17:54:09 -06:00
cifsroot.c
…
cifssmb.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
cifstransport.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
compress.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
compress.h
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
connect.c
smb: client: improve error message when creating SMB session
2025-12-05 17:40:38 -06:00
dfs_cache.c
smb: client: handle lack of IPC in dfs_cache_refresh()
2025-10-29 20:13:05 -05:00
dfs_cache.h
…
dfs.c
smb: client: don't trust DFSREF_STORAGE_SERVER bit
2025-02-05 21:09:00 -06:00
dfs.h
smb: client: get rid of kstrdup() in get_ses_refpath()
2025-02-05 21:09:07 -06:00
dir.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
dns_resolve.c
smb: client: provide dns_resolve_{unc,name} helpers
2025-01-19 19:34:00 -06:00
dns_resolve.h
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
export.c
exportfs: make ->encode_fh() a mandatory method for NFS export
2023-10-28 16:15:15 +02:00
file.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
fs_context.c
cifs: Fix memory and information leak in smb3_reconfigure()
2025-12-24 11:07:15 -06:00
fs_context.h
cifs: client: enforce consistent handling of multichannel and max_channels
2025-12-03 23:32:44 -06:00
fscache.c
cifs: Remove some code that's no longer used, part 1
2024-05-01 18:08:21 +01:00
fscache.h
cifs: Remove some code that's no longer used, part 1
2024-05-01 18:08:21 +01:00
inode.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
ioctl.c
smb3 client: add missing tracepoint for unsupported ioctls
2025-12-30 09:16:45 -06:00
Kconfig
smb: client: Remove obsolete crypto_shash allocations
2025-10-15 22:10:28 -05:00
link.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
Makefile
cifs: Move the SMB1 transport code out of transport.c
2025-08-06 12:01:54 -05:00
misc.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
namespace.c
Merge tag 'v6.16-rc-part1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
2025-06-03 16:04:29 -07:00
netlink.c
…
netlink.h
…
netmisc.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
nterr.c
smb/client: add 4 NT error code definitions
2025-12-09 21:21:42 -06:00
nterr.h
smb/client: add parentheses to NT error code definitions containing bitwise OR operator
2025-12-09 21:22:34 -06:00
ntlmssp.h
smb: fix some warnings reported by scripts/checkpatch.pl
2025-11-30 21:11:45 -06:00
readdir.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
reparse.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
reparse.h
smb: do some cleanups
2025-11-30 21:11:45 -06:00
rfc1002pdu.h
smb: fix some warnings reported by scripts/checkpatch.pl
2025-11-30 21:11:45 -06:00
sess.c
cifs: client: allow changing multichannel mount options on remount
2025-12-05 17:14:14 -06:00
smb1ops.c
cifs: Remove the server pointer from smb_message
2025-12-05 17:10:48 -06:00
smb2file.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
smb2glob.h
smb: client: fix data loss due to broken rename(2)
2025-09-09 18:39:58 -05:00
smb2inode.c
cifs: Do some preparation prior to organising the function declarations
2025-12-05 17:11:55 -06:00
smb2maperror.c
smb/client: update some SMB2 status strings
2025-12-07 11:46:19 -06:00
smb2misc.c
cifs: Remove the RFC1002 header from smb_hdr
2025-12-05 17:09:32 -06:00
smb2ops.c
smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range
2025-12-30 09:17:41 -06:00
smb2pdu.c
smb: client: Add tracepoint for krb5 auth
2025-12-05 17:40:42 -06:00
smb2pdu.h
smb: move some duplicate struct definitions to common/fscc.h
2025-11-30 21:11:45 -06:00
smb2proto.h
cifs: Remove dead function prototypes
2025-12-05 17:54:09 -06:00
smb2transport.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
smbdirect.c
smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall()
2025-11-30 21:11:45 -06:00
smbdirect.h
smb: client: change smbd_deregister_mr() to return void
2025-10-13 08:26:22 -05:00
smbencrypt.c
smb: client: delete "true", "false" defines
2024-01-23 12:41:02 -06:00
smberr.h
…
trace.c
smb: client: Add tracepoint for krb5 auth
2025-12-05 17:40:42 -06:00
trace.h
smb3 client: add missing tracepoint for unsupported ioctls
2025-12-30 09:16:45 -06:00
transport.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00
unc.c
…
winucase.c
…
xattr.c
cifs: Add a tracepoint to log EIO errors
2025-12-05 17:11:43 -06:00