Hyunchul Lee
5776196055
ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT ...
commit 824d4f64c20093275f72fc8101394d75ff6a249e upstream.
if Status is not 0 and PathLength is long,
smb_strndup_from_utf16 could make out of bound
read in smb2_tree_connnect.
This bug can lead an oops looking something like:
[ 1553.882047] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
[ 1553.882064] Read of size 2 at addr ffff88802c4eda04 by task kworker/0:2/42805
...
[ 1553.882095] Call Trace:
[ 1553.882098] <TASK>
[ 1553.882101] dump_stack_lvl+0x49/0x5f
[ 1553.882107] print_report.cold+0x5e/0x5cf
[ 1553.882112] ? smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
[ 1553.882122] kasan_report+0xaa/0x120
[ 1553.882128] ? smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
[ 1553.882139] __asan_report_load_n_noabort+0xf/0x20
[ 1553.882143] smb_strndup_from_utf16+0x469/0x4c0 [ksmbd]
[ 1553.882155] ? smb_strtoUTF16+0x3b0/0x3b0 [ksmbd]
[ 1553.882166] ? __kmalloc_node+0x185/0x430
[ 1553.882171] smb2_tree_connect+0x140/0xab0 [ksmbd]
[ 1553.882185] handle_ksmbd_work+0x30e/0x1020 [ksmbd]
[ 1553.882197] process_one_work+0x778/0x11c0
[ 1553.882201] ? _raw_spin_lock_irq+0x8e/0xe0
[ 1553.882206] worker_thread+0x544/0x1180
[ 1553.882209] ? __cpuidle_text_end+0x4/0x4
[ 1553.882214] kthread+0x282/0x320
[ 1553.882218] ? process_one_work+0x11c0/0x11c0
[ 1553.882221] ? kthread_complete_and_exit+0x30/0x30
[ 1553.882225] ret_from_fork+0x1f/0x30
[ 1553.882231] </TASK>
There is no need to check error request validation in server.
This check allow invalid requests not to validate message.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17818
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-17 14:22:56 +02:00
2022-06-29 09:03:19 +02:00
2022-06-29 09:03:25 +02:00
2021-10-20 21:09:02 -04:00
2021-08-19 09:02:55 +09:00
2022-08-17 14:22:54 +02:00
2022-07-02 16:41:14 +02:00
2022-07-21 21:24:30 +02:00
2022-06-14 18:36:25 +02:00
2022-03-02 11:48:02 +01:00
2021-11-18 19:16:11 +01:00
2022-01-27 11:03:55 +01:00
2022-02-01 17:27:01 +01:00
2022-07-29 17:25:24 +02:00
2022-07-02 16:41:14 +02:00
2022-05-01 17:22:32 +02:00
2022-07-29 17:25:30 +02:00
2022-06-09 10:23:32 +02:00
2022-04-08 14:23:35 +02:00
2022-06-22 14:22:05 +02:00
2022-06-29 09:03:27 +02:00
2022-06-09 10:22:42 +02:00
2021-10-04 22:13:12 +01:00
2022-05-01 17:22:28 +02:00
2022-07-12 16:34:59 +02:00
2021-08-26 22:28:02 +02:00
2021-07-27 11:00:36 +02:00
2022-06-09 10:23:11 +02:00
2022-06-09 10:22:55 +02:00
2021-11-12 15:05:50 +01:00
2022-04-27 14:39:02 +02:00
2022-06-14 18:36:10 +02:00
2022-06-09 10:22:41 +02:00
2022-06-14 18:36:22 +02:00
2022-08-17 14:22:56 +02:00
2022-08-17 14:22:47 +02:00
2022-04-13 20:59:10 +02:00
2021-12-29 12:28:59 +01:00
2022-08-17 14:22:45 +02:00
2021-10-04 22:02:17 +01:00
2022-08-17 14:22:45 +02:00
2022-07-21 21:24:14 +02:00
2022-06-09 10:22:50 +02:00
2022-08-03 12:03:41 +02:00
2022-06-09 10:23:32 +02:00
2022-08-03 12:03:41 +02:00
2022-01-20 09:13:13 +01:00
2022-08-17 14:22:51 +02:00
2022-07-29 17:25:11 +02:00
2022-04-08 14:23:01 +02:00
2021-09-21 08:36:48 -07:00
2022-06-22 14:21:56 +02:00
2021-09-03 15:33:47 -07:00
2021-12-14 10:57:12 +01:00
2021-08-16 10:50:32 -06:00
2021-08-06 13:05:28 +02:00
2022-03-02 11:48:05 +01:00
2022-04-08 14:24:08 +02:00
2022-05-15 20:18:52 +02:00
2021-08-19 09:02:55 +09:00
2021-09-27 11:26:21 -07:00
2021-09-22 10:56:34 -07:00
2022-07-29 17:25:09 +02:00
2022-06-25 15:18:40 +02:00
2021-12-14 10:57:22 +01:00
2022-08-17 14:22:50 +02:00
2021-08-18 22:08:24 +02:00
2021-09-05 10:15:05 -07:00
2022-04-08 14:24:17 +02:00
2022-04-08 14:24:18 +02:00
2022-06-09 10:22:26 +02:00
2022-04-08 14:22:54 +02:00
2022-04-08 14:24:18 +02:00
2021-09-02 10:07:29 -07:00
2022-06-09 10:23:09 +02:00
2021-09-03 09:58:10 -07:00
2021-09-06 07:20:56 -04:00
2021-09-09 13:25:49 -07:00
2022-07-21 21:24:11 +02:00
2021-09-03 10:08:28 -07:00
2022-05-18 10:26:57 +02:00
2022-04-08 14:23:54 +02:00
2021-08-23 01:25:40 -04:00
2022-01-20 09:13:14 +01:00
2021-09-07 16:07:47 -04:00
2022-06-14 18:36:26 +02:00
2022-06-14 18:36:26 +02:00
2022-04-27 14:38:50 +02:00
2022-07-12 16:35:08 +02:00
2021-12-22 09:32:51 +01:00
2021-08-29 07:55:55 -06:00
2022-05-25 09:57:26 +02:00
2021-09-12 10:10:21 -07:00
2021-07-25 22:33:03 -07:00
2021-10-18 20:22:03 -10:00
2021-09-07 11:21:48 -07:00
2021-09-12 10:10:21 -07:00
2022-08-17 14:22:50 +02:00
2022-07-02 16:41:17 +02:00
2022-07-02 16:41:17 +02:00
2022-06-06 08:43:37 +02:00
2022-07-02 16:41:17 +02:00
2022-07-02 16:41:14 +02:00
2022-08-03 12:03:41 +02:00
2022-07-21 21:24:14 +02:00
2022-01-29 10:58:25 +01:00
2022-07-12 16:35:08 +02:00
2021-12-14 10:57:15 +01:00
2022-04-27 14:38:57 +02:00
2022-02-23 12:03:05 +01:00
2022-04-27 14:38:50 +02:00
2021-08-10 17:57:22 +02:00
2021-10-18 20:22:02 -10:00
2022-07-02 16:41:17 +02:00
5776196055