superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/fs/smb/client
History
Fredric Cover 78ec5bf2f5 fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath 
When cifs_sanitize_prepath is called with an empty string or a string
containing only delimiters (e.g., "/"), the current logic attempts to
check *(cursor2 - 1) before cursor2 has advanced. This results in an
out-of-bounds read.

This patch adds an early exit check after stripping prepended
delimiters. If no path content remains, the function returns NULL.

The bug was identified via manual audit and verified using a
standalone test case compiled with AddressSanitizer, which
triggered a SEGV on affected inputs.

Signed-off-by: Fredric Cover <FredTheDude@proton.me>
Reviewed-by: Henrique Carvalho <[2]henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
 		2026-03-31 18:21:14 -05:00
..
compress move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
.gitignore smb client: Add generated file to gitignore file 2026-02-10 08:23:13 -08:00
Kconfig smb: client: Remove obsolete crypto_shash allocations 2025-10-15 22:10:28 -05:00
Makefile smb/client: ensure smb2_mapping_table rebuild on cmd changes 2026-03-23 08:17:26 -05:00
asn1.c smb3: add support for IAKerb 2025-01-31 12:51:44 -06:00
cached_dir.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
cached_dir.h smb: client: Avoid a dozen -Wflex-array-member-not-at-end warnings 2026-02-08 21:24:42 -06:00
cifs_debug.c cifs: SMB1 split: cifs_debug.c 2026-02-08 17:07:45 -06:00
cifs_debug.h cifs: SMB1 split: cifs_debug.c 2026-02-08 17:07:45 -06:00
cifs_fs_sb.h smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
cifs_ioctl.h smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
cifs_spnego.c smb: client: Add tracepoint for krb5 auth 2025-12-05 17:40:42 -06:00
cifs_spnego.h cifs: Scripted clean up fs/smb/client/cifs_spnego.h 2026-02-08 17:07:44 -06:00
cifs_spnego_negtokeninit.asn1
…
cifs_swn.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
cifs_swn.h cifs: Scripted clean up fs/smb/client/cifs_swn.h 2026-02-08 17:07:44 -06:00
cifs_unicode.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
cifs_unicode.h smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
cifsacl.c smb: client: fix open handle lookup in cifs_open() 2026-03-11 18:46:40 -05:00
cifsacl.h smb: client: Correct typos in multiple comments across various files 2024-10-02 17:52:24 -05:00
cifsencrypt.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cifsfs.c smb: client: fix open handle lookup in cifs_open() 2026-03-11 18:46:40 -05:00
cifsfs.h cifs: update internal module version number 2026-02-13 23:03:41 -06:00
cifsglob.h smb: client: fix generic/694 due to wrong ->i_blocks 2026-03-19 13:56:25 -05:00
cifspdu.h cifs: SMB1 split: Move BCC access functions 2026-02-08 17:07:45 -06:00
cifsproto.h smb: client: fix open handle lookup in cifs_open() 2026-03-11 18:46:40 -05:00
cifsroot.c
…
cifssmb.c cifs: SMB1 split: connect.c 2026-02-08 17:07:46 -06:00
compress.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compress.h cifs: Scripted clean up fs/smb/client/compress.h 2026-02-08 17:07:44 -06:00
connect.c smb: client: fix krb5 mount with username option 2026-03-15 20:53:09 -05:00
dfs.c smb: client: don't trust DFSREF_STORAGE_SERVER bit 2025-02-05 21:09:00 -06:00
dfs.h Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dfs_cache.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
dfs_cache.h cifs: Scripted clean up fs/smb/client/dfs_cache.h 2026-02-08 17:07:44 -06:00
dir.c smb: client: fix sbflags initialization 2026-03-10 17:22:03 -05:00
dns_resolve.c smb: client: provide dns_resolve_{unc,name} helpers 2025-01-19 19:34:00 -06:00
dns_resolve.h cifs: Scripted clean up fs/smb/client/dns_resolve.h 2026-02-08 17:07:44 -06:00
export.c
…
file.c smb: client: fix generic/694 due to wrong ->i_blocks 2026-03-19 13:56:25 -05:00
fs_context.c fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath 2026-03-31 18:21:14 -05:00
fs_context.h smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
fscache.c
…
fscache.h cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h 2026-02-08 17:07:45 -06:00
gen_smb2_mapping cifs: Autogenerate SMB2 error mapping table 2026-02-08 21:23:53 -06:00
inode.c smb: client: fix generic/694 due to wrong ->i_blocks 2026-03-19 13:56:25 -05:00
ioctl.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
link.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
misc.c cifs: open files should not hold ref on superblock 2026-03-04 10:11:39 -06:00
namespace.c 13 smb3/cifs client fixes 2025-06-03 16:04:29 -07:00
netlink.c
…
netlink.h cifs: Scripted clean up fs/smb/client/netlink.h 2026-02-08 17:07:44 -06:00
netmisc.c cifs: SMB1 split: netmisc.c 2026-02-08 17:07:45 -06:00
nterr.c smb/client: rename to NT_STATUS_SOME_NOT_MAPPED 2026-02-12 14:22:29 -06:00
nterr.h smb/client: move NT_STATUS_MORE_ENTRIES 2026-02-12 14:22:29 -06:00
ntlmssp.h cifs: Scripted clean up fs/smb/client/ntlmssp.h 2026-02-08 17:07:45 -06:00
readdir.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
reparse.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
reparse.h smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
rfc1002pdu.h smb: fix some warnings reported by scripts/checkpatch.pl 2025-11-30 21:11:45 -06:00
sess.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
smb1debug.c cifs: SMB1 split: cifs_debug.c 2026-02-08 17:07:45 -06:00
smb1encrypt.c smb: client: Compare MACs in constant time 2026-03-03 20:56:36 -06:00
smb1maperror.c smb/client: map NT_STATUS_PRIVILEGE_NOT_HELD 2026-02-12 14:22:29 -06:00
smb1misc.c cifs: SMB1 split: netmisc.c 2026-02-08 17:07:45 -06:00
smb1ops.c smb: client: fix open handle lookup in cifs_open() 2026-03-11 18:46:40 -05:00
smb1pdu.h cifs: SMB1 split: Split SMB1 protocol defs into smb1pdu.h 2026-02-08 17:07:45 -06:00
smb1proto.h cifs: SMB1 split: Make BCC accessors conditional 2026-02-08 17:07:46 -06:00
smb1session.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
smb1transport.c cifs: smb1: fix comment typo 2026-03-16 21:12:40 -05:00
smb2file.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
smb2glob.h smb/client: make SMB2 maperror KUnit tests a separate module 2026-03-01 17:59:52 -06:00
smb2inode.c smb: client: fix open handle lookup in cifs_open() 2026-03-11 18:46:40 -05:00
smb2maperror.c smb/client: only export symbol for 'smb2maperror-test' module 2026-03-10 17:22:04 -05:00
smb2maperror_test.c smb/client: make SMB2 maperror KUnit tests a separate module 2026-03-01 17:59:52 -06:00
smb2misc.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
smb2ops.c smb: client: fix generic/694 due to wrong ->i_blocks 2026-03-19 13:56:25 -05:00
smb2pdu.c smb: client: fix in-place encryption corruption in SMB2_write() 2026-03-10 17:22:03 -05:00
smb2pdu.h smb: update some doc references 2026-03-01 17:59:52 -06:00
smb2proto.h smb/client: remove unused SMB311_posix_query_info() 2026-03-03 18:03:56 -06:00
smb2transport.c smb: client: Compare MACs in constant time 2026-03-03 20:56:36 -06:00
smbdirect.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
smbdirect.h smb: client: change smbd_deregister_mr() to return void 2025-10-13 08:26:22 -05:00
smbencrypt.c cifs: SMB1 split: Adjust #includes 2026-02-08 17:07:45 -06:00
smberr.h smb/client: rename ERRinvlevel to ERRunknownlevel 2026-02-08 21:24:41 -06:00
trace.c smb: client: Add tracepoint for krb5 auth 2025-12-05 17:40:42 -06:00
trace.h cifs: open files should not hold ref on superblock 2026-03-04 10:11:39 -06:00
transport.c smb: client: fix cifs_pick_channel when channels are equally loaded 2026-02-22 16:52:50 -06:00
unc.c
…
winucase.c
…
xattr.c smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00