mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/fs/ksmbd
History
Hyunchul Lee d3015b3bf4 ksmbd: prevent out of bound read for SMB2_WRITE 
[ Upstream commit ac60778b87 ]

OOB read memory can be written to a file,
if DataOffset is 0 and Length is too large
in SMB2_WRITE request of compound request.

To prevent this, when checking the length of
the data area of SMB2_WRITE in smb2_get_data_area_len(),
let the minimum of DataOffset be the size of
SMB2 header + the size of SMB2_WRITE header.

This bug can lead an oops looking something like:

[  798.008715] BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0xd3d/0x14b0
[  798.008724] Read of size 252 at addr ffff88800f863e90 by task kworker/0:2/2859
...
[  798.008754] Call Trace:
[  798.008756]  <TASK>
[  798.008759]  dump_stack_lvl+0x49/0x5f
[  798.008764]  print_report.cold+0x5e/0x5cf
[  798.008768]  ? __filemap_get_folio+0x285/0x6d0
[  798.008774]  ? copy_page_from_iter_atomic+0xd3d/0x14b0
[  798.008777]  kasan_report+0xaa/0x120
[  798.008781]  ? copy_page_from_iter_atomic+0xd3d/0x14b0
[  798.008784]  kasan_check_range+0x100/0x1e0
[  798.008788]  memcpy+0x24/0x60
[  798.008792]  copy_page_from_iter_atomic+0xd3d/0x14b0
[  798.008795]  ? pagecache_get_page+0x53/0x160
[  798.008799]  ? iov_iter_get_pages_alloc+0x1590/0x1590
[  798.008803]  ? ext4_write_begin+0xfc0/0xfc0
[  798.008807]  ? current_time+0x72/0x210
[  798.008811]  generic_perform_write+0x2c8/0x530
[  798.008816]  ? filemap_fdatawrite_wbc+0x180/0x180
[  798.008820]  ? down_write+0xb4/0x120
[  798.008824]  ? down_write_killable+0x130/0x130
[  798.008829]  ext4_buffered_write_iter+0x137/0x2c0
[  798.008833]  ext4_file_write_iter+0x40b/0x1490
[  798.008837]  ? __fsnotify_parent+0x275/0xb20
[  798.008842]  ? __fsnotify_update_child_dentry_flags+0x2c0/0x2c0
[  798.008846]  ? ext4_buffered_write_iter+0x2c0/0x2c0
[  798.008851]  __kernel_write+0x3a1/0xa70
[  798.008855]  ? __x64_sys_preadv2+0x160/0x160
[  798.008860]  ? security_file_permission+0x4a/0xa0
[  798.008865]  kernel_write+0xbb/0x360
[  798.008869]  ksmbd_vfs_write+0x27e/0xb90 [ksmbd]
[  798.008881]  ? ksmbd_vfs_read+0x830/0x830 [ksmbd]
[  798.008892]  ? _raw_read_unlock+0x2a/0x50
[  798.008896]  smb2_write+0xb45/0x14e0 [ksmbd]
[  798.008909]  ? __kasan_check_write+0x14/0x20
[  798.008912]  ? _raw_spin_lock_bh+0xd0/0xe0
[  798.008916]  ? smb2_read+0x15e0/0x15e0 [ksmbd]
[  798.008927]  ? memcpy+0x4e/0x60
[  798.008931]  ? _raw_spin_unlock+0x19/0x30
[  798.008934]  ? ksmbd_smb2_check_message+0x16af/0x2350 [ksmbd]
[  798.008946]  ? _raw_spin_lock_bh+0xe0/0xe0
[  798.008950]  handle_ksmbd_work+0x30e/0x1020 [ksmbd]
[  798.008962]  process_one_work+0x778/0x11c0
[  798.008966]  ? _raw_spin_lock_irq+0x8e/0xe0
[  798.008970]  worker_thread+0x544/0x1180
[  798.008973]  ? __cpuidle_text_end+0x4/0x4
[  798.008977]  kthread+0x282/0x320
[  798.008982]  ? process_one_work+0x11c0/0x11c0
[  798.008985]  ? kthread_complete_and_exit+0x30/0x30
[  798.008989]  ret_from_fork+0x1f/0x30
[  798.008995]  </TASK>

Fixes: e2f34481b2 ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17817
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-08-17 14:42:30 +02:00
..
mgmt ksmbd: fix multi session connection failure 2021-12-28 22:47:22 -06:00
Kconfig ksmbd: remove md4 leftovers 2021-11-11 19:22:58 -06:00
Makefile
…
asn1.c ksmbd: use oid registry functions to decode OIDs 2021-12-28 22:47:22 -06:00
asn1.h
…
auth.c ksmbd: add support for key exchange 2022-02-04 00:12:22 -06:00
auth.h ksmbd: fix multi session connection failure 2021-12-28 22:47:22 -06:00
connection.c ksmbd: smbd: change prototypes of RDMA read/write related functions 2022-08-17 14:42:30 +02:00
connection.h ksmbd: smbd: change prototypes of RDMA read/write related functions 2022-08-17 14:42:30 +02:00
crypto_ctx.c ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
crypto_ctx.h ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
glob.h ksmbd: fix version mismatch with out of tree 2021-10-07 10:18:34 -05:00
ksmbd_netlink.h ksmbd: add smbd max io size parameter 2022-08-17 14:42:30 +02:00
ksmbd_spnego_negtokeninit.asn1
…
ksmbd_spnego_negtokentarg.asn1
…
ksmbd_work.c ksmbd: Remove redundant 'flush_workqueue()' calls 2021-11-06 23:52:06 -05:00
ksmbd_work.h ksmbd: remove smb2_buf_length in smb2_hdr 2021-11-11 19:22:58 -06:00
misc.c ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
misc.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
ndr.c ksmbd: fix error code in ndr_read_int32() 2021-12-16 12:36:49 -06:00
ndr.h ksmbd: add user namespace support 2021-07-02 16:27:10 +09:00
nterr.h
…
ntlmssp.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00
oplock.c ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
oplock.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
server.c ksmbd: shorten experimental warning on loading the module 2022-03-30 08:14:59 -05:00
server.h ksmbd: change server config string index to enumeration 2021-06-30 14:44:01 +09:00
smb2misc.c ksmbd: prevent out of bound read for SMB2_WRITE 2022-08-17 14:42:30 +02:00
smb2ops.c ksmbd: add support for smb2 max credit parameter 2022-01-10 12:44:19 -06:00
smb2pdu.c ksmbd: prevent out of bound read for SMB2_WRITE 2022-08-17 14:42:30 +02:00
smb2pdu.h 14 fixes to cifs client and to smbfs_common code 2022-04-01 14:31:57 -07:00
smb_common.c ksmbd: fix outstanding credits related bugs 2022-06-09 10:30:51 +02:00
smb_common.h ksmbd: add support for smb2 max credit parameter 2022-01-10 12:44:19 -06:00
smbacl.c ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-17 14:40:15 +02:00
smbacl.h ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-17 14:40:15 +02:00
smbfsctl.h
…
smbstatus.h
…
transport_ipc.c ksmbd: add smbd max io size parameter 2022-08-17 14:42:30 +02:00
transport_ipc.h ksmbd: throttle session setup failures to avoid dictionary attacks 2021-10-20 00:07:10 -05:00
transport_rdma.c ksmbd: fix wrong smbd max read/write size check 2022-08-17 14:42:30 +02:00
transport_rdma.h ksmbd: fix wrong smbd max read/write size check 2022-08-17 14:42:30 +02:00
transport_tcp.c ksmbd: use SOCK_NONBLOCK type for kernel_accept() 2022-07-22 10:21:46 +02:00
transport_tcp.h
…
unicode.c
…
unicode.h
…
uniupr.h
…
vfs.c ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-17 14:40:15 +02:00
vfs.h ksmbd: don't align last entry offset in smb2 query directory 2022-02-04 00:12:22 -06:00
vfs_cache.c ksmbd: increment reference count of parent fp 2022-04-14 20:56:13 -05:00
vfs_cache.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
xattr.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00