diff options
| author | Henrique Carvalho <henrique.carvalho@suse.com> | 2025-12-29 14:49:43 -0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2025-12-30 09:17:41 -0600 |
| commit | fa2fd0b10f66b08bc44745feed1761d7c1539d6e (patch) | |
| tree | c2120a3bbf733288130b25717ef8e94ea4475889 /tools/lib/python/kdoc/python_version.py | |
| parent | bc311611625a8aaa26813809a2c820fcd286ba2b (diff) | |
smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range
struct copychunk_ioctl_req::ChunkCount is annotated with
__counted_by_le() as the number of elements in Chunks[].
smb2_copychunk_range reuses ChunkCount to store the number of chunks
sent in the current iteration. If a later iteration populates more
chunks than a previous one, the stale smaller value trips UBSAN.
Set ChunkCount to chunk_count (allocated capacity) before populating
Chunks[].
Fixes: cc26f593dc19 ("smb: move copychunk definitions to common/smb2pdu.h")
Link: https://lore.kernel.org/linux-cifs/CAH2r5ms9AWLy8WZ04Cpq5XOeVK64tcrUQ6__iMW+yk1VPzo1BA@mail.gmail.com
Tested-by: Youling Tang <tangyouling@kylinos.cn>
Acked-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions