Namjae Jeon 368ba06881 ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop ... The length field of netbios header must be greater than the SMB header sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet. If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`. In the function `get_smb2_cmd_val` ksmbd will read cmd from `rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN detector to print the following error message: [ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60 [ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task ksmbd:42632/248 ... [ 7.207125] <TASK> [ 7.209191] get_smb2_cmd_val+0x45/0x60 [ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100 [ 7.209712] ksmbd_server_process_request+0x72/0x160 [ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550 [ 7.212280] kthread+0x160/0x190 [ 7.212762] ret_from_fork+0x1f/0x30 [ 7.212981] </TASK> Cc: stable@vger.kernel.org Reported-by: Chih-Yen Chang <cc85nod@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>		2023-06-02 12:30:57 -05:00
..
mgmt
asn1.c
asn1.h
auth.c
auth.h
connection.c	ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop	2023-06-02 12:30:57 -05:00
connection.h
crypto_ctx.c
crypto_ctx.h
glob.h
Kconfig
ksmbd_netlink.h
ksmbd_spnego_negtokeninit.asn1
ksmbd_spnego_negtokentarg.asn1
ksmbd_work.c
ksmbd_work.h
Makefile
misc.c
misc.h
ndr.c
ndr.h
nterr.h
ntlmssp.h
oplock.c	ksmbd: fix out-of-bound read in parse_lease_state()	2023-06-02 12:30:57 -05:00
oplock.h
server.c
server.h
smb2misc.c
smb2ops.c
smb2pdu.c	ksmbd: fix out-of-bound read in deassemble_neg_contexts()	2023-06-02 12:30:57 -05:00
smb2pdu.h
smb_common.c
smb_common.h
smbacl.c	ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()	2023-06-02 12:30:57 -05:00
smbacl.h
smbfsctl.h
smbstatus.h
transport_ipc.c
transport_ipc.h
transport_rdma.c
transport_rdma.h
transport_tcp.c
transport_tcp.h
unicode.c
unicode.h
uniupr.h
vfs.c	ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()	2023-06-02 12:30:57 -05:00
vfs.h
vfs_cache.c
vfs_cache.h
xattr.h