iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Paulo Alcantara 3a42709fa9 smb: client: fix OOB in smb2_query_reparse_point() 
Validate @ioctl_rsp->OutputOffset and @ioctl_rsp->OutputCount so that
their sum does not wrap to a number that is smaller than @reparse_buf
and we end up with a wild pointer as follows:

  BUG: unable to handle page fault for address: ffff88809c5cd45f
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 4a01067 P4D 4a01067 PUD 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 2 PID: 1260 Comm: mount.cifs Not tainted 6.7.0-rc4 #2
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
  RIP: 0010:smb2_query_reparse_point+0x3e0/0x4c0 [cifs]
  Code: ff ff e8 f3 51 fe ff 41 89 c6 58 5a 45 85 f6 0f 85 14 fe ff ff
  49 8b 57 48 8b 42 60 44 8b 42 64 42 8d 0c 00 49 39 4f 50 72 40 <8b>
  04 02 48 8b 9d f0 fe ff ff 49 8b 57 50 89 03 48 8b 9d e8 fe ff
  RSP: 0018:ffffc90000347a90 EFLAGS: 00010212
  RAX: 000000008000001f RBX: ffff88800ae11000 RCX: 00000000000000ec
  RDX: ffff88801c5cd440 RSI: 0000000000000000 RDI: ffffffff82004aa4
  RBP: ffffc90000347bb0 R08: 00000000800000cd R09: 0000000000000001
  R10: 0000000000000000 R11: 0000000000000024 R12: ffff8880114d4100
  R13: ffff8880114d4198 R14: 0000000000000000 R15: ffff8880114d4000
  FS: 00007f02c07babc0(0000) GS:ffff88806ba00000(0000)
  knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffff88809c5cd45f CR3: 0000000011750000 CR4: 0000000000750ef0
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? __die+0x23/0x70
   ? page_fault_oops+0x181/0x480
   ? search_module_extables+0x19/0x60
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? exc_page_fault+0x1b6/0x1c0
   ? asm_exc_page_fault+0x26/0x30
   ? _raw_spin_unlock_irqrestore+0x44/0x60
   ? smb2_query_reparse_point+0x3e0/0x4c0 [cifs]
   cifs_get_fattr+0x16e/0xa50 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? lock_acquire+0xbf/0x2b0
   cifs_root_iget+0x163/0x5f0 [cifs]
   cifs_smb3_do_mount+0x5bd/0x780 [cifs]
   smb3_get_tree+0xd9/0x290 [cifs]
   vfs_get_tree+0x2c/0x100
   ? capable+0x37/0x70
   path_mount+0x2d7/0xb80
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? _raw_spin_unlock_irqrestore+0x44/0x60
   __x64_sys_mount+0x11a/0x150
   do_syscall_64+0x47/0xf0
   entry_SYSCALL_64_after_hwframe+0x6f/0x77
  RIP: 0033:0x7f02c08d5b1e

Fixes: 2e4564b31b64 ("smb3: add support for stat of WSL reparse points for special file types")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2023-12-11 12:30:39 -06:00
..
9p
Bunch of small fixes:
2023-11-04 09:20:04 -10:00
adfs
adfs: convert to new timestamp accessors
2023-10-18 13:26:18 +02:00
affs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
afs
afs: Mark a superblock for an R/O or Backup volume as SB_RDONLY
2023-11-24 14:52:24 +00:00
autofs
autofs: add: new_inode check in autofs_fill_super()
2023-11-20 14:56:36 +01:00
bcachefs
bcachefs: Extra kthread_should_stop() calls for copygc
2023-11-28 22:58:23 -05:00
befs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
bfs
bfs: convert to new timestamp accessors
2023-10-18 13:26:19 +02:00
btrfs
for-6.7-rc3-tag
2023-11-28 11:16:04 -08:00
cachefiles
- Some swap cleanups from Ma Wupeng ("fix WARN_ON in add_to_avail_list")
2023-08-29 14:25:26 -07:00
ceph
Two items:
2023-11-10 09:52:56 -08:00
coda
coda: convert to new timestamp accessors
2023-10-18 13:26:19 +02:00
configfs
configfs: convert to new timestamp accessors
2023-10-18 13:26:19 +02:00
cramfs
vfs-6.7.ctime
2023-10-30 09:47:13 -10:00
crypto
This update includes the following changes:
2023-11-02 16:15:30 -10:00
debugfs
Revert "debugfs: annotate debugfs handlers vs. removal with lockdep"
2023-12-04 07:43:16 +01:00
devpts
devpts: convert to new timestamp accessors
2023-10-18 13:26:20 +02:00
dlm
dlm: slow down filling up processing queue
2023-10-12 15:21:00 -05:00
ecryptfs
fs: Pass AT_GETATTR_NOSEC flag to getattr interface function
2023-11-18 14:54:07 +01:00
efivarfs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
efs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
erofs
MAINTAINERS: erofs: add EROFS webpage
2023-11-17 19:55:46 +08:00
exfat
exfat: fix ctime is not updated
2023-11-03 22:24:11 +09:00
exportfs
fs: fix build error with CONFIG_EXPORTFS=m or not defined
2023-10-28 16:16:19 +02:00
ext2
ext2: Fix ki_pos update for DIO buffered-io fallback case
2023-11-22 10:17:10 +01:00
ext4
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
f2fs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
fat
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
freevxfs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
fscache
fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()
2023-01-30 12:51:54 +00:00
fuse
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
gfs2
gfs2 fixes
2023-11-07 11:54:17 -08:00
hfs
vfs-6.7.ctime
2023-10-30 09:47:13 -10:00
hfsplus
vfs-6.7.ctime
2023-10-30 09:47:13 -10:00
hostfs
hostfs: convert to new timestamp accessors
2023-10-18 14:08:22 +02:00
hpfs
hpfs: convert to new timestamp accessors
2023-10-18 14:08:22 +02:00
hugetlbfs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
iomap
Many singleton patches against the MM code. The patch series which are
2023-11-02 19:38:47 -10:00
isofs
isofs: convert to new timestamp accessors
2023-10-18 14:08:22 +02:00
jbd2
Many singleton patches against the MM code. The patch series which are
2023-11-02 19:38:47 -10:00
jffs2
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
jfs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
kernfs
Driver core changes for 6.7-rc1
2023-11-03 15:15:47 -10:00
lockd
SUNRPC: change how svc threads are asked to exit.
2023-10-16 12:44:04 -04:00
minix
minix: convert to new timestamp accessors
2023-10-18 14:08:23 +02:00
netfs
netfs: Only call folio_start_fscache() one time for each folio
2023-09-18 12:03:46 -07:00
nfs
NFS client updates for Linux 6.7
2023-11-08 13:39:16 -08:00
nfs_common
NFSv4.2: remove MODULE_LICENSE in non-modules
2023-04-13 13:13:52 -07:00
nfsd
nfsd-6.7 fixes:
2023-11-18 11:23:32 -08:00
nilfs2
nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
2023-12-06 16:12:50 -08:00
nls
nls: Hide new NLS_UCS2_UTILS
2023-08-31 12:07:34 -05:00
notify
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
ntfs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
ntfs3
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
ocfs2
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
omfs
omfs: convert to new timestamp accessors
2023-10-18 14:08:25 +02:00
openpromfs
openpromfs: convert to new timestamp accessors
2023-10-18 14:08:25 +02:00
orangefs
vfs-6.7.ctime
2023-10-30 09:47:13 -10:00
overlayfs
vfs-6.7-rc3.fixes
2023-11-24 09:45:40 -08:00
proc
mm/pagemap: fix wr-protect even if PM_SCAN_WP_MATCHING not set
2023-12-06 16:12:45 -08:00
pstore
pstore updates for v6.7-rc1
2023-10-30 19:26:39 -10:00
qnx4
qnx4: convert to new timestamp accessors
2023-10-18 14:08:26 +02:00
qnx6
qnx6: convert to new timestamp accessors
2023-10-18 14:08:26 +02:00
quota
Many singleton patches against the MM code. The patch series which are
2023-11-02 19:38:47 -10:00
ramfs
ramfs: convert to new timestamp accessors
2023-10-18 14:08:26 +02:00
reiserfs
Many singleton patches against the MM code. The patch series which are
2023-11-02 19:38:47 -10:00
romfs
vfs-6.7.ctime
2023-10-30 09:47:13 -10:00
smb
smb: client: fix OOB in smb2_query_reparse_point()
2023-12-11 12:30:39 -06:00
squashfs
squashfs: squashfs_read_data need to check if the length is 0
2023-12-06 16:12:45 -08:00
sysfs
kernfs: sysfs: support custom llseek method for sysfs entries
2023-10-05 13:42:11 +02:00
sysv
sysv: convert to new timestamp accessors
2023-10-18 14:08:28 +02:00
tracefs
eventfs: Make sure that parent->d_inode is locked in creating files/dirs
2023-11-22 18:37:33 -05:00
ubifs
This pull request contains updates for UBI and UBIFS
2023-11-05 08:28:32 -10:00
udf
\n
2023-11-02 08:19:51 -10:00
ufs
vfs-6.7.fsid
2023-11-07 12:11:26 -08:00
unicode
unicode: remove MODULE_LICENSE in non-modules
2023-04-13 13:13:54 -07:00
vboxsf
vboxsf: convert to new timestamp accessors
2023-10-18 14:08:29 +02:00
verity
fsverity: skip PKCS#7 parser when keyring is empty
2023-08-20 10:33:43 -07:00
xfs
Code changes for 6.7-rc2:
2023-11-25 08:57:09 -08:00
zonefs
zonefs: convert to new timestamp accessors
2023-10-18 14:08:29 +02:00
aio.c
aio: Annotate struct kioctx_table with __counted_by
2023-09-20 14:22:01 +02:00
anon_inodes.c
treewide: mark stuff as __ro_after_init
2023-10-18 14:43:23 -07:00
attr.c
fs: convert core infrastructure to new timestamp accessors
2023-10-18 13:26:15 +02:00
bad_inode.c
fs: convert core infrastructure to new timestamp accessors
2023-10-18 13:26:15 +02:00
binfmt_elf_fdpic.c
execve updates for v6.7-rc1
2023-10-30 19:28:19 -10:00
binfmt_elf_test.c
…
binfmt_elf.c
binfmt_elf: Only report padzero() errors when PROT_WRITE
2023-10-03 19:48:44 -07:00
binfmt_flat.c
…
binfmt_misc.c
execve updates for v6.7-rc1
2023-10-30 19:28:19 -10:00
binfmt_script.c
…
buffer.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
char_dev.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
compat_binfmt_elf.c
…
coredump.c
v6.5/vfs.misc
2023-06-26 09:50:21 -07:00
d_path.c
fs: d_path: include internal.h
2023-05-17 09:16:59 +02:00
dax.c
mm: convert DAX lock/unlock page to lock/unlock folio
2023-10-04 10:32:20 -07:00
dcache.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
direct-io.c
treewide: mark stuff as __ro_after_init
2023-10-18 14:43:23 -07:00
drop_caches.c
fs: drop_caches: draining pages before dropping caches
2023-08-18 10:12:11 -07:00
eventfd.c
eventfd: prevent underflow for eventfd semaphores
2023-07-11 11:41:34 +02:00
eventpoll.c
treewide: mark stuff as __ro_after_init
2023-10-18 14:43:23 -07:00
exec.c
mm/mremap: allow moves within the same VMA for stack moves
2023-10-04 10:32:20 -07:00
fcntl.c
treewide: mark stuff as __ro_after_init
2023-10-18 14:43:23 -07:00
fhandle.c
exportfs: add helpers to check if filesystem can encode/decode file handles
2023-10-24 17:57:45 +02:00
file_table.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
file.c
file, i915: fix file reference for mmap_singleton()
2023-10-25 22:17:04 +02:00
filesystems.c
…
fs_context.c
fs: factor out vfs_parse_monolithic_sep() helper
2023-10-12 18:53:36 +03:00
fs_parser.c
ext4: journal_path mount options should follow links
2022-12-01 10:46:54 -05:00
fs_pin.c
…
fs_struct.c
kill do_each_thread()
2023-08-21 13:46:25 -07:00
fs_types.c
…
fs-writeback.c
vfs-6.7.misc
2023-10-30 09:14:19 -10:00
fsopen.c
fsconfig: ensure that dirfd is set to aux
2023-09-22 14:09:06 +02:00
init.c
fs: add a new SB_I_NOUMASK flag
2023-10-19 11:02:47 +02:00
inode.c
filemap: add a per-mapping stable writes flag
2023-11-20 15:05:18 +01:00
internal.h
fs: store real path instead of fake path in backing file f_path
2023-10-19 11:03:15 +02:00
ioctl.c
v6.6-vfs.super
2023-08-28 11:04:18 -07:00
Kconfig
mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI
2023-12-06 16:12:49 -08:00
Kconfig.binfmt
riscv: support the elf-fdpic binfmt loader
2023-08-23 14:17:43 -07:00
kernel_read_file.c
fs: Fix kernel-doc warnings
2023-08-19 12:12:12 +02:00
libfs.c
libfs: getdents() should return 0 after reaching EOD
2023-11-20 15:34:22 +01:00
locks.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
Makefile
bcachefs: Initial commit
2023-10-22 17:08:07 -04:00
mbcache.c
mbcache: dynamically allocate the mbcache shrinker
2023-10-04 10:32:25 -07:00
mnt_idmapping.c
fs: export mnt_idmap_get/mnt_idmap_put
2023-11-03 23:28:33 +01:00
mount.h
…
mpage.c
buffer: remove folio_create_empty_buffers()
2023-10-25 16:47:10 -07:00
namei.c
vfs-6.7.misc
2023-10-30 09:14:19 -10:00
namespace.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
nsfs.c
fs: convert core infrastructure to new timestamp accessors
2023-10-18 13:26:15 +02:00
open.c
fs: store real path instead of fake path in backing file f_path
2023-10-19 11:03:15 +02:00
pipe.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
pnode.c
fs: allow to mount beneath top mount
2023-05-19 04:30:22 +02:00
pnode.h
fs: allow to mount beneath top mount
2023-05-19 04:30:22 +02:00
posix_acl.c
fs: convert to ctime accessor functions
2023-07-13 10:28:04 +02:00
proc_namespace.c
tty, proc, kernfs, random: Use copy_splice_read()
2023-05-24 08:42:16 -06:00
read_write.c
fs: Fix one kernel-doc comment
2023-08-15 08:32:45 +02:00
readdir.c
vfs: get rid of old '->iterate' directory operation
2023-08-06 15:08:35 +02:00
remap_range.c
fs: use UB-safe check for signed addition overflow in remap_verify_area
2023-05-24 11:03:59 +02:00
select.c
…
seq_file.c
use less confusing names for iov_iter direction initializers
2022-11-25 13:01:55 -05:00
signalfd.c
…
splice.c
- Some swap cleanups from Ma Wupeng ("fix WARN_ON in add_to_avail_list")
2023-08-29 14:25:26 -07:00
stack.c
fs: convert core infrastructure to new timestamp accessors
2023-10-18 13:26:15 +02:00
stat.c
fs: Pass AT_GETATTR_NOSEC flag to getattr interface function
2023-11-18 14:54:07 +01:00
statfs.c
statfs: enforce statfs[64] structure initialization
2023-05-17 15:20:17 +02:00
super.c
overlayfs update for 6.7-rc1
2023-11-07 11:46:31 -08:00
sync.c
…
sysctls.c
sysctl: Refactor base paths registrations
2023-05-23 21:43:26 -07:00
timerfd.c
…
userfaultfd.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
utimes.c
fs.idmapped.v6.3
2023-02-20 11:53:11 -08:00
xattr.c
xattr: make the xattr array itself const
2023-10-09 16:24:16 +02:00