In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0<\/p>\n
With len == 0 (clone to EOF), the effective length is computed as:<\/p>\n
len = src_inode->i_size – off;<\/p>\n
If off > i_size, this is a negative loff_t, corrupting the ByteCount
\nin the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range
\nin filemap_write_and_wait_range(). The existing off >= i_size check
\nfires only after the ioctl has already been sent.<\/p>\n
Snapshot i_size_read() once for both the bounds check and the length
\ncalculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject
\noff > src_size with -EINVAL. Treat off == src_size as a no-op,
\nconsistent with __generic_remap_file_range_prep().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0<\/p>\n
With len == 0 (clone to EOF), the effective length is computed<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21562","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}