lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 0109/1157] ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT
    Date
    From: Hyunchul Lee <hyc.lee@gmail.com>

    commit 824d4f64c20093275f72fc8101394d75ff6a249e upstream.

    if Status is not 0 and PathLength is long,
    smb_strndup_from_utf16 could make out of bound
    read in smb2_tree_connnect.

    This bug can lead an oops looking something like:

    [ 1553.882047] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
    [ 1553.882064] Read of size 2 at addr ffff88802c4eda04 by task kworker/0:2/42805
    ...
    [ 1553.882095] Call Trace:
    [ 1553.882098] <TASK>
    [ 1553.882101] dump_stack_lvl+0x49/0x5f
    [ 1553.882107] print_report.cold+0x5e/0x5cf
    [ 1553.882112] ? smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
    [ 1553.882122] kasan_report+0xaa/0x120
    [ 1553.882128] ? smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
    [ 1553.882139] __asan_report_load_n_noabort+0xf/0x20
    [ 1553.882143] smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
    [ 1553.882155] ? smb_strtoUTF16+0x3b0/0x3b0 [ksmbd]
    [ 1553.882166] ? __kmalloc_node+0x185/0x430
    [ 1553.882171] smb2_tree_connect+0x140/0xab0 [ksmbd]
    [ 1553.882185] handle_ksmbd_work+0x30e/0x1020 [ksmbd]
    [ 1553.882197] process_one_work+0x778/0x11c0
    [ 1553.882201] ? _raw_spin_lock_irq+0x8e/0xe0
    [ 1553.882206] worker_thread+0x544/0x1180
    [ 1553.882209] ? __cpuidle_text_end+0x4/0x4
    [ 1553.882214] kthread+0x282/0x320
    [ 1553.882218] ? process_one_work+0x11c0/0x11c0
    [ 1553.882221] ? kthread_complete_and_exit+0x30/0x30
    [ 1553.882225] ret_from_fork+0x1f/0x30
    [ 1553.882231] </TASK>

    There is no need to check error request validation in server.
    This check allow invalid requests not to validate message.

    Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
    Cc: stable@vger.kernel.org
    Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17818
    Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/ksmbd/smb2misc.c | 5 -----
    1 file changed, 5 deletions(-)

    --- a/fs/ksmbd/smb2misc.c
    +++ b/fs/ksmbd/smb2misc.c
    @@ -90,11 +90,6 @@ static int smb2_get_data_area_len(unsign
    *off = 0;
    *len = 0;

    - /* error reqeusts do not have data area */
    - if (hdr->Status && hdr->Status != STATUS_MORE_PROCESSING_REQUIRED &&
    - (((struct smb2_err_rsp *)hdr)->StructureSize) == SMB2_ERROR_STRUCTURE_SIZE2_LE)
    - return ret;
    -
    /*
    * Following commands have data areas so we have to get the location
    * of the data buffer offset and data buffer length for the particular

    \
     
     \ /
      Last update: 2022-08-16 00:22    [W:3.917 / U:0.232 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site