Namjae Jeon cb69d4d6f7 ksmbd: fix heap-based overflow in set_ntacl_dacl() ... commit 8f0541186e upstream. The testcase use SMB2_SET_INFO_HE command to set a malformed file attribute under the label `security.NTACL`. SMB2_QUERY_INFO_HE command in testcase trigger the following overflow. [ 4712.003781] ================================================================== [ 4712.003790] BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.003807] Write of size 1060 at addr ffff88801e34c068 by task kworker/0:0/4190 [ 4712.003813] CPU: 0 PID: 4190 Comm: kworker/0:0 Not tainted 5.19.0-rc5 #1 [ 4712.003850] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 4712.003867] Call Trace: [ 4712.003870] <TASK> [ 4712.003873] dump_stack_lvl+0x49/0x5f [ 4712.003935] print_report.cold+0x5e/0x5cf [ 4712.003972] ? ksmbd_vfs_get_sd_xattr+0x16d/0x500 [ksmbd] [ 4712.003984] ? cmp_map_id+0x200/0x200 [ 4712.003988] ? build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.004000] kasan_report+0xaa/0x120 [ 4712.004045] ? build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.004056] kasan_check_range+0x100/0x1e0 [ 4712.004060] memcpy+0x3c/0x60 [ 4712.004064] build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.004076] ? parse_sec_desc+0x580/0x580 [ksmbd] [ 4712.004088] ? ksmbd_acls_fattr+0x281/0x410 [ksmbd] [ 4712.004099] smb2_query_info+0xa8f/0x6110 [ksmbd] [ 4712.004111] ? psi_group_change+0x856/0xd70 [ 4712.004148] ? update_load_avg+0x1c3/0x1af0 [ 4712.004152] ? asym_cpu_capacity_scan+0x5d0/0x5d0 [ 4712.004157] ? xas_load+0x23/0x300 [ 4712.004162] ? smb2_query_dir+0x1530/0x1530 [ksmbd] [ 4712.004173] ? _raw_spin_lock_bh+0xe0/0xe0 [ 4712.004179] handle_ksmbd_work+0x30e/0x1020 [ksmbd] [ 4712.004192] process_one_work+0x778/0x11c0 [ 4712.004227] ? _raw_spin_lock_irq+0x8e/0xe0 [ 4712.004231] worker_thread+0x544/0x1180 [ 4712.004234] ? __cpuidle_text_end+0x4/0x4 [ 4712.004239] kthread+0x282/0x320 [ 4712.004243] ? process_one_work+0x11c0/0x11c0 [ 4712.004246] ? kthread_complete_and_exit+0x30/0x30 [ 4712.004282] ret_from_fork+0x1f/0x30 This patch add the buffer validation for security descriptor that is stored by malformed SMB2_SET_INFO_HE command. and allocate large response buffer about SMB2_O_INFO_SECURITY file info class. Fixes: e2f34481b2 ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17771 Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-08-21 15:17:48 +02:00
..
mgmt	ksmbd: throttle session setup failures to avoid dictionary attacks	2021-10-20 00:07:10 -05:00
asn1.c
asn1.h
auth.c	ksmbd: add buffer validation in session setup	2021-10-20 00:07:10 -05:00
auth.h
connection.c	ksmbd: fix outstanding credits related bugs	2022-06-09 10:23:27 +02:00
connection.h	ksmbd: limits exceeding the maximum allowable outstanding requests	2022-01-27 11:02:53 +01:00
crypto_ctx.c	ksmbd: remove NTLMv1 authentication	2021-09-29 16:17:34 -05:00
crypto_ctx.h	ksmbd: remove NTLMv1 authentication	2021-09-29 16:17:34 -05:00
glob.h	ksmbd: fix version mismatch with out of tree	2021-10-07 10:18:34 -05:00
Kconfig	ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION	2021-11-18 19:16:07 +01:00
ksmbd_netlink.h	ksmbd: add reserved room in ipc request/response	2022-01-27 11:02:53 +01:00
ksmbd_spnego_negtokeninit.asn1
ksmbd_spnego_negtokentarg.asn1
ksmbd_work.c	ksmbd: reorder and document on-disk and netlink structures in headers	2021-06-30 14:47:24 +09:00
ksmbd_work.h	ksmbd: change data type of volatile/persistent id to u64	2021-07-09 08:23:16 +09:00
Makefile
misc.c	ksmbd: missing check for NULL in convert_to_nt_pathname()	2021-09-30 20:00:05 -05:00
misc.h	ksmbd: use LOOKUP_BENEATH to prevent the out of share access	2021-09-24 21:25:23 -05:00
ndr.c	ksmbd: fix error code in ndr_read_int32()	2021-12-29 12:28:57 +01:00
ndr.h	ksmbd: add user namespace support	2021-07-02 16:27:10 +09:00
nterr.h
ntlmssp.h
oplock.c	ksmbd: add buffer validation for SMB2_CREATE_CONTEXT	2021-09-30 09:58:07 -05:00
oplock.h	ksmbd: remove SMB1 oplock level macros	2021-06-30 14:43:51 +09:00
server.c	ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION	2021-11-18 19:16:07 +01:00
server.h	ksmbd: change server config string index to enumeration	2021-06-30 14:44:01 +09:00
smb2misc.c	ksmbd: prevent out of bound read for SMB2_WRITE	2022-08-21 15:17:48 +02:00
smb2ops.c	ksmbd: add support for smb2 max credit parameter	2022-01-27 11:02:53 +01:00
smb2pdu.c	ksmbd: fix heap-based overflow in set_ntacl_dacl()	2022-08-21 15:17:48 +02:00
smb2pdu.h	ksmbd: add support for smb2 max credit parameter	2022-01-27 11:02:53 +01:00
smb_common.c	ksmbd: fix outstanding credits related bugs	2022-06-09 10:23:27 +02:00
smb_common.h	ksmbd: add support for smb2 max credit parameter	2022-01-27 11:02:53 +01:00
smbacl.c	ksmbd: fix heap-based overflow in set_ntacl_dacl()	2022-08-21 15:17:48 +02:00
smbacl.h	ksmbd: fix heap-based overflow in set_ntacl_dacl()	2022-08-21 15:17:48 +02:00
smbfsctl.h
smbstatus.h
transport_ipc.c	ksmbd: add support for smb2 max credit parameter	2022-01-27 11:02:53 +01:00
transport_ipc.h	ksmbd: throttle session setup failures to avoid dictionary attacks	2021-10-20 00:07:10 -05:00
transport_rdma.c	ksmbd: add buffer validation for smb direct	2021-10-15 09:18:29 -05:00
transport_rdma.h	ksmbd: fix typo of MS-SMBD	2021-07-22 09:55:58 +09:00
transport_tcp.c	ksmbd: use SOCK_NONBLOCK type for kernel_accept()	2022-07-21 21:24:32 +02:00
transport_tcp.h
unicode.c
unicode.h
uniupr.h
vfs.c	ksmbd: fix heap-based overflow in set_ntacl_dacl()	2022-08-21 15:17:48 +02:00
vfs.h	ksmbd: don't align last entry offset in smb2 query directory	2022-02-23 12:03:18 +01:00
vfs_cache.c	ksmbd: increment reference count of parent fp	2022-05-09 09:14:40 +02:00
vfs_cache.h	ksmbd: remove unused ksmbd_file_table_flush function	2021-09-03 23:29:45 -05:00
xattr.h	ksmbd: reorder and document on-disk and netlink structures in headers	2021-06-30 14:47:24 +09:00