mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
ksmbd: validate session id and tree id in the compound request
This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21165 Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
parent
5fe7f7b782
commit
5005bcb421
2 changed files with 59 additions and 18 deletions
|
@ -185,24 +185,31 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
|
|||
goto send;
|
||||
}
|
||||
|
||||
if (conn->ops->check_user_session) {
|
||||
rc = conn->ops->check_user_session(work);
|
||||
if (rc < 0) {
|
||||
command = conn->ops->get_cmd_val(work);
|
||||
conn->ops->set_rsp_status(work,
|
||||
STATUS_USER_SESSION_DELETED);
|
||||
goto send;
|
||||
} else if (rc > 0) {
|
||||
rc = conn->ops->get_ksmbd_tcon(work);
|
||||
do {
|
||||
if (conn->ops->check_user_session) {
|
||||
rc = conn->ops->check_user_session(work);
|
||||
if (rc < 0) {
|
||||
conn->ops->set_rsp_status(work,
|
||||
STATUS_NETWORK_NAME_DELETED);
|
||||
if (rc == -EINVAL)
|
||||
conn->ops->set_rsp_status(work,
|
||||
STATUS_INVALID_PARAMETER);
|
||||
else
|
||||
conn->ops->set_rsp_status(work,
|
||||
STATUS_USER_SESSION_DELETED);
|
||||
goto send;
|
||||
} else if (rc > 0) {
|
||||
rc = conn->ops->get_ksmbd_tcon(work);
|
||||
if (rc < 0) {
|
||||
if (rc == -EINVAL)
|
||||
conn->ops->set_rsp_status(work,
|
||||
STATUS_INVALID_PARAMETER);
|
||||
else
|
||||
conn->ops->set_rsp_status(work,
|
||||
STATUS_NETWORK_NAME_DELETED);
|
||||
goto send;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
do {
|
||||
rc = __process_request(work, conn, &command);
|
||||
if (rc == SERVER_HANDLER_ABORT)
|
||||
break;
|
||||
|
|
|
@ -91,7 +91,6 @@ int smb2_get_ksmbd_tcon(struct ksmbd_work *work)
|
|||
unsigned int cmd = le16_to_cpu(req_hdr->Command);
|
||||
int tree_id;
|
||||
|
||||
work->tcon = NULL;
|
||||
if (cmd == SMB2_TREE_CONNECT_HE ||
|
||||
cmd == SMB2_CANCEL_HE ||
|
||||
cmd == SMB2_LOGOFF_HE) {
|
||||
|
@ -105,10 +104,28 @@ int smb2_get_ksmbd_tcon(struct ksmbd_work *work)
|
|||
}
|
||||
|
||||
tree_id = le32_to_cpu(req_hdr->Id.SyncId.TreeId);
|
||||
|
||||
/*
|
||||
* If request is not the first in Compound request,
|
||||
* Just validate tree id in header with work->tcon->id.
|
||||
*/
|
||||
if (work->next_smb2_rcv_hdr_off) {
|
||||
if (!work->tcon) {
|
||||
pr_err("The first operation in the compound does not have tcon\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
if (work->tcon->id != tree_id) {
|
||||
pr_err("tree id(%u) is different with id(%u) in first operation\n",
|
||||
tree_id, work->tcon->id);
|
||||
return -EINVAL;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
work->tcon = ksmbd_tree_conn_lookup(work->sess, tree_id);
|
||||
if (!work->tcon) {
|
||||
pr_err("Invalid tid %d\n", tree_id);
|
||||
return -EINVAL;
|
||||
return -ENOENT;
|
||||
}
|
||||
|
||||
return 1;
|
||||
|
@ -547,7 +564,6 @@ int smb2_check_user_session(struct ksmbd_work *work)
|
|||
unsigned int cmd = conn->ops->get_cmd_val(work);
|
||||
unsigned long long sess_id;
|
||||
|
||||
work->sess = NULL;
|
||||
/*
|
||||
* SMB2_ECHO, SMB2_NEGOTIATE, SMB2_SESSION_SETUP command do not
|
||||
* require a session id, so no need to validate user session's for
|
||||
|
@ -558,15 +574,33 @@ int smb2_check_user_session(struct ksmbd_work *work)
|
|||
return 0;
|
||||
|
||||
if (!ksmbd_conn_good(conn))
|
||||
return -EINVAL;
|
||||
return -EIO;
|
||||
|
||||
sess_id = le64_to_cpu(req_hdr->SessionId);
|
||||
|
||||
/*
|
||||
* If request is not the first in Compound request,
|
||||
* Just validate session id in header with work->sess->id.
|
||||
*/
|
||||
if (work->next_smb2_rcv_hdr_off) {
|
||||
if (!work->sess) {
|
||||
pr_err("The first operation in the compound does not have sess\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
if (work->sess->id != sess_id) {
|
||||
pr_err("session id(%llu) is different with the first operation(%lld)\n",
|
||||
sess_id, work->sess->id);
|
||||
return -EINVAL;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Check for validity of user session */
|
||||
work->sess = ksmbd_session_lookup_all(conn, sess_id);
|
||||
if (work->sess)
|
||||
return 1;
|
||||
ksmbd_debug(SMB, "Invalid user session, Uid %llu\n", sess_id);
|
||||
return -EINVAL;
|
||||
return -ENOENT;
|
||||
}
|
||||
|
||||
static void destroy_previous_session(struct ksmbd_conn *conn,
|
||||
|
|
Loading…
Reference in a new issue