• Namjae Jeon's avatar
    ksmbd: replace one-element array with flex-array member in struct smb2_ea_info · 0ba5439d
    Namjae Jeon authored
    UBSAN complains about out-of-bounds array indexes on 1-element arrays in
    struct smb2_ea_info.
    
    UBSAN: array-index-out-of-bounds in fs/smb/server/smb2pdu.c:4335:15
    index 1 is out of range for type 'char [1]'
    CPU: 1 PID: 354 Comm: kworker/1:4 Not tainted 6.5.0-rc4 #1
    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
    Reference Platform, BIOS 6.00 07/22/2020
    Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
    Call Trace:
     <TASK>
     __dump_stack linux/lib/dump_stack.c:88
     dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
     dump_stack+0x10/0x20 linux/lib/dump_stack.c:113
     ubsan_epilogue linux/lib/ubsan.c:217
     __ubsan_handle_out_of_bounds+0xc6/0x110 linux/lib/ubsan.c:348
     smb2_get_ea linux/fs/smb/server/smb2pdu.c:4335
     smb2_get_info_file linux/fs/smb/server/smb2pdu.c:4900
     smb2_query_info+0x63ae/0x6b20 linux/fs/smb/server/smb2pdu.c:5275
     __process_request linux/fs/smb/server/server.c:145
     __handle_ksmbd_work linux/fs/smb/server/server.c:213
     handle_ksmbd_work+0x348/0x10b0 linux/fs/smb/server/server.c:266
     process_one_work+0x85a/0x1500 linux/kernel/workqueue.c:2597
     worker_thread+0xf3/0x13a0 linux/kernel/workqueue.c:2748
     kthread+0x2b7/0x390 linux/kernel/kthread.c:389
     ret_from_fork+0x44/0x90 linux/arch/x86/kernel/process.c:145
     ret_from_fork_asm+0x1b/0x30 linux/arch/x86/entry/entry_64.S:304
     </TASK>
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
    0ba5439d
smb2pdu.h 12.9 KB