diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2025-10-16 10:53:13 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-10-31 06:46:03 -0700 |
| commit | 1a2352ad82b515035efe563f997ef8f5ca4f8080 (patch) | |
| tree | 5ab09f8bb295fef3b0ae901438132fbe757e9d95 /fs/smb/server/transport_ipc.c | |
| parent | 0d0eb186421d0886ac466008235f6d9eedaf918e (diff) | |
| parent | e5763491237ffee22d9b554febc2d00669f81dee (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR (net-6.18-rc4).
No conflicts, adjacent changes:
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
ded9813d17d3 ("net: stmmac: Consider Tx VLAN offload tag length for maxSDU")
26ab9830beab ("net: stmmac: replace has_xxxx with core_type")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'fs/smb/server/transport_ipc.c')
| -rw-r--r-- | fs/smb/server/transport_ipc.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c index 46f87fd1ce1c..2c08cccfa680 100644 --- a/fs/smb/server/transport_ipc.c +++ b/fs/smb/server/transport_ipc.c @@ -263,10 +263,16 @@ static void ipc_msg_handle_free(int handle) static int handle_response(int type, void *payload, size_t sz) { - unsigned int handle = *(unsigned int *)payload; + unsigned int handle; struct ipc_msg_table_entry *entry; int ret = 0; + /* Prevent 4-byte read beyond declared payload size */ + if (sz < sizeof(unsigned int)) + return -EINVAL; + + handle = *(unsigned int *)payload; + ipc_update_last_active(); down_read(&ipc_msg_table_lock); hash_for_each_possible(ipc_msg_table, entry, ipc_table_hlist, handle) { |