summaryrefslogtreecommitdiff
path: root/fs/ksmbd
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2021-11-30 15:50:47 +0300
committerSteve French <stfrench@microsoft.com>2021-12-16 12:36:49 -0600
commitef399469d9ceb9f2171cdd79863f9434b9fa3edc (patch)
treed258ecfcb83c02084077874b5260239fb8d7a46b /fs/ksmbd
parent2585cf9dfaaddf00b069673f27bb3f8530e2039c (diff)
ksmbd: fix error code in ndr_read_int32()
This is a failure path and it should return -EINVAL instead of success. Otherwise it could result in the caller using uninitialized memory. Fixes: 303fff2b8c77 ("ksmbd: add validation for ndr read/write functions") Cc: stable@vger.kernel.org # v5.15 Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/ksmbd')
-rw-r--r--fs/ksmbd/ndr.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ksmbd/ndr.c b/fs/ksmbd/ndr.c
index 8317f7ca402b..5052be9261d9 100644
--- a/fs/ksmbd/ndr.c
+++ b/fs/ksmbd/ndr.c
@@ -148,7 +148,7 @@ static int ndr_read_int16(struct ndr *n, __u16 *value)
static int ndr_read_int32(struct ndr *n, __u32 *value)
{
if (n->offset + sizeof(__u32) > n->length)
- return 0;
+ return -EINVAL;
if (value)
*value = le32_to_cpu(*(__le32 *)ndr_get_field(n));