ksmbd: prevent out-of-bounds stream writes by validating *pos

ksmbd_vfs_stream_write() did not validate whether the write offset
(*pos) was within the bounds of the existing stream data length (v_len).
If *pos was greater than or equal to v_len, this could lead to an
out-of-bounds memory write.

This patch adds a check to ensure *pos is less than v_len before
proceeding. If the condition fails, -EINVAL is returned.

Cc: stable@vger.kernel.org
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 391d07da586c73e8cd272e1e0d58d9f01ba41c93..482eba0f4dc11a7eebcffe5a5e1805549642a32b 100644 (file)
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -426,6 +426,13 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
                goto out;
        }
 
+       if (v_len <= *pos) {
+               pr_err("stream write position %lld is out of bounds (stream length: %zd)\n",
+                               *pos, v_len);
+               err = -EINVAL;
+               goto out;
+       }
+
        if (v_len < size) {
                wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);
                if (!wbuf) {