Re: [PATCH 1/7] ksmbd: add validation in smb2_ioctl

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



2021-09-25 19:16 GMT+09:00, Hyunchul Lee <hyc.lee@xxxxxxxxx>:
> 2021년 9월 24일 (금) 오전 11:13, Namjae Jeon <linkinjeon@xxxxxxxxxx>님이 작성:
>>
>> Add validation for request/response buffer size check in smb2_ioctl and
>> fsctl_copychunk() take copychunk_ioctl_req pointer and the other
>> arguments
>> instead of smb2_ioctl_req structure and remove an unused smb2_ioctl_req
>> argument of fsctl_validate_negotiate_info.
>>
>> Cc: Tom Talpey <tom@xxxxxxxxxx>
>> Cc: Ronnie Sahlberg <ronniesahlberg@xxxxxxxxx>
>> Cc: Ralph Böhme <slow@xxxxxxxxx>
>> Cc: Steve French <smfrench@xxxxxxxxx>
>> Cc: Hyunchul Lee <hyc.lee@xxxxxxxxx>
>> Cc: Sergey Senozhatsky <senozhatsky@xxxxxxxxxxxx>
>> Signed-off-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
>> ---
>>  fs/ksmbd/smb2pdu.c | 87 ++++++++++++++++++++++++++++++++++++----------
>>  1 file changed, 68 insertions(+), 19 deletions(-)
>>
>> diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
>> index 0c49a0e887d3..b22d4207c077 100644
>> --- a/fs/ksmbd/smb2pdu.c
>> +++ b/fs/ksmbd/smb2pdu.c
>> @@ -6927,24 +6927,26 @@ int smb2_lock(struct ksmbd_work *work)
>>         return err;
>>  }
>>
>> -static int fsctl_copychunk(struct ksmbd_work *work, struct smb2_ioctl_req
>> *req,
>> +static int fsctl_copychunk(struct ksmbd_work *work,
>> +                          struct copychunk_ioctl_req *ci_req,
>> +                          unsigned int cnt_code,
>> +                          unsigned int input_count,
>> +                          unsigned long long volatile_id,
>> +                          unsigned long long persistent_id,
>>                            struct smb2_ioctl_rsp *rsp)
>>  {
>> -       struct copychunk_ioctl_req *ci_req;
>>         struct copychunk_ioctl_rsp *ci_rsp;
>>         struct ksmbd_file *src_fp = NULL, *dst_fp = NULL;
>>         struct srv_copychunk *chunks;
>>         unsigned int i, chunk_count, chunk_count_written = 0;
>>         unsigned int chunk_size_written = 0;
>>         loff_t total_size_written = 0;
>> -       int ret, cnt_code;
>> +       int ret = 0;
>>
>> -       cnt_code = le32_to_cpu(req->CntCode);
>> -       ci_req = (struct copychunk_ioctl_req *)&req->Buffer[0];
>>         ci_rsp = (struct copychunk_ioctl_rsp *)&rsp->Buffer[0];
>>
>> -       rsp->VolatileFileId = req->VolatileFileId;
>> -       rsp->PersistentFileId = req->PersistentFileId;
>> +       rsp->VolatileFileId = cpu_to_le64(volatile_id);
>> +       rsp->PersistentFileId = cpu_to_le64(persistent_id);
>>         ci_rsp->ChunksWritten =
>>                 cpu_to_le32(ksmbd_server_side_copy_max_chunk_count());
>>         ci_rsp->ChunkBytesWritten =
>> @@ -6954,12 +6956,13 @@ static int fsctl_copychunk(struct ksmbd_work
>> *work, struct smb2_ioctl_req *req,
>>
>>         chunks = (struct srv_copychunk *)&ci_req->Chunks[0];
>>         chunk_count = le32_to_cpu(ci_req->ChunkCount);
>> +       if (chunk_count == 0)
>> +               goto out;
>>         total_size_written = 0;
>>
>>         /* verify the SRV_COPYCHUNK_COPY packet */
>>         if (chunk_count > ksmbd_server_side_copy_max_chunk_count() ||
>> -           le32_to_cpu(req->InputCount) <
>> -            offsetof(struct copychunk_ioctl_req, Chunks) +
>> +           input_count < offsetof(struct copychunk_ioctl_req, Chunks) +
>>              chunk_count * sizeof(struct srv_copychunk)) {
>>                 rsp->hdr.Status = STATUS_INVALID_PARAMETER;
>>                 return -EINVAL;
>> @@ -6980,9 +6983,7 @@ static int fsctl_copychunk(struct ksmbd_work *work,
>> struct smb2_ioctl_req *req,
>>
>>         src_fp = ksmbd_lookup_foreign_fd(work,
>>
>> le64_to_cpu(ci_req->ResumeKey[0]));
>> -       dst_fp = ksmbd_lookup_fd_slow(work,
>> -                                     le64_to_cpu(req->VolatileFileId),
>> -
>> le64_to_cpu(req->PersistentFileId));
>> +       dst_fp = ksmbd_lookup_fd_slow(work, volatile_id, persistent_id);
>>         ret = -EINVAL;
>>         if (!src_fp ||
>>             src_fp->persistent_id != le64_to_cpu(ci_req->ResumeKey[1])) {
>> @@ -7057,8 +7058,8 @@ static __be32 idev_ipv4_address(struct in_device
>> *idev)
>>  }
>>
>>  static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,
>> -                                       struct smb2_ioctl_req *req,
>> -                                       struct smb2_ioctl_rsp *rsp)
>> +                                       struct smb2_ioctl_rsp *rsp,
>> +                                       int out_buf_len)
>>  {
>>         struct network_interface_info_ioctl_rsp *nii_rsp = NULL;
>>         int nbytes = 0;
>> @@ -7141,6 +7142,8 @@ static int fsctl_query_iface_info_ioctl(struct
>> ksmbd_conn *conn,
>>                         sockaddr_storage->addr6.ScopeId = 0;
>>                 }
>>
>> +               if (out_buf_len < sizeof(struct
>> network_interface_info_ioctl_rsp))
>> +                       break;
>
> Do we need to check whether the remaining(len out_buf_len - nbytes) is
> less than sizeof(struct network_interface_info_ioctl_rsp)?
Right. will fix it on next version. Thanks for your review!
>
>>                 nbytes += sizeof(struct
>> network_interface_info_ioctl_rsp);
>>         }
>>         rtnl_unlock();
>> @@ -7161,11 +7164,16 @@ static int fsctl_query_iface_info_ioctl(struct
>> ksmbd_conn *conn,
>>
>>  static int fsctl_validate_negotiate_info(struct ksmbd_conn *conn,
>>                                          struct
>> validate_negotiate_info_req *neg_req,
>> -                                        struct
>> validate_negotiate_info_rsp *neg_rsp)
>> +                                        struct
>> validate_negotiate_info_rsp *neg_rsp,
>> +                                        int in_buf_len)
>>  {
>>         int ret = 0;
>>         int dialect;
>>
>> +       if (in_buf_len < sizeof(struct validate_negotiate_info_req) +
>> +                       le16_to_cpu(neg_req->DialectCount) *
>> sizeof(__le16))
>> +               return -EINVAL;
>> +
>>         dialect = ksmbd_lookup_dialect_by_id(neg_req->Dialects,
>>                                              neg_req->DialectCount);
>>         if (dialect == BAD_PROT_ID || dialect != conn->dialect) {
>> @@ -7341,7 +7349,7 @@ int smb2_ioctl(struct ksmbd_work *work)
>>         struct smb2_ioctl_req *req;
>>         struct smb2_ioctl_rsp *rsp, *rsp_org;
>>         int cnt_code, nbytes = 0;
>> -       int out_buf_len;
>> +       int out_buf_len, in_buf_len;
>>         u64 id = KSMBD_NO_FID;
>>         struct ksmbd_conn *conn = work->conn;
>>         int ret = 0;
>> @@ -7371,6 +7379,7 @@ int smb2_ioctl(struct ksmbd_work *work)
>>         cnt_code = le32_to_cpu(req->CntCode);
>>         out_buf_len = le32_to_cpu(req->MaxOutputResponse);
>>         out_buf_len = min(KSMBD_IPC_MAX_PAYLOAD, out_buf_len);
>> +       in_buf_len = le32_to_cpu(req->InputCount);
>>
>>         switch (cnt_code) {
>>         case FSCTL_DFS_GET_REFERRALS:
>> @@ -7406,9 +7415,16 @@ int smb2_ioctl(struct ksmbd_work *work)
>>                         goto out;
>>                 }
>>
>> +               if (in_buf_len < sizeof(struct
>> validate_negotiate_info_req))
>> +                       return -EINVAL;
>> +
>> +               if (out_buf_len < sizeof(struct
>> validate_negotiate_info_rsp))
>> +                       return -EINVAL;
>> +
>>                 ret = fsctl_validate_negotiate_info(conn,
>>                         (struct validate_negotiate_info_req
>> *)&req->Buffer[0],
>> -                       (struct validate_negotiate_info_rsp
>> *)&rsp->Buffer[0]);
>> +                       (struct validate_negotiate_info_rsp
>> *)&rsp->Buffer[0],
>> +                       in_buf_len);
>>                 if (ret < 0)
>>                         goto out;
>>
>> @@ -7417,7 +7433,7 @@ int smb2_ioctl(struct ksmbd_work *work)
>>                 rsp->VolatileFileId = cpu_to_le64(SMB2_NO_FID);
>>                 break;
>>         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
>> -               nbytes = fsctl_query_iface_info_ioctl(conn, req, rsp);
>> +               nbytes = fsctl_query_iface_info_ioctl(conn, rsp,
>> out_buf_len);
>>                 if (nbytes < 0)
>>                         goto out;
>>                 break;
>> @@ -7444,15 +7460,33 @@ int smb2_ioctl(struct ksmbd_work *work)
>>                         goto out;
>>                 }
>>
>> +               if (in_buf_len < sizeof(struct copychunk_ioctl_req)) {
>> +                       ret = -EINVAL;
>> +                       goto out;
>> +               }
>> +
>>                 if (out_buf_len < sizeof(struct copychunk_ioctl_rsp)) {
>>                         ret = -EINVAL;
>>                         goto out;
>>                 }
>>
>>                 nbytes = sizeof(struct copychunk_ioctl_rsp);
>> -               fsctl_copychunk(work, req, rsp);
>> +               rsp->VolatileFileId = req->VolatileFileId;
>> +               rsp->PersistentFileId = req->PersistentFileId;
>> +               fsctl_copychunk(work,
>> +                               (struct copychunk_ioctl_req
>> *)&req->Buffer[0],
>> +                               le32_to_cpu(req->CntCode),
>> +                               le32_to_cpu(req->InputCount),
>> +                               le64_to_cpu(req->VolatileFileId),
>> +                               le64_to_cpu(req->PersistentFileId),
>> +                               rsp);
>>                 break;
>>         case FSCTL_SET_SPARSE:
>> +               if (in_buf_len < sizeof(struct file_sparse)) {
>> +                       ret = -EINVAL;
>> +                       goto out;
>> +               }
>> +
>>                 ret = fsctl_set_sparse(work, id,
>>                                        (struct file_sparse
>> *)&req->Buffer[0]);
>>                 if (ret < 0)
>> @@ -7471,6 +7505,11 @@ int smb2_ioctl(struct ksmbd_work *work)
>>                         goto out;
>>                 }
>>
>> +               if (in_buf_len < sizeof(struct
>> file_zero_data_information)) {
>> +                       ret = -EINVAL;
>> +                       goto out;
>> +               }
>> +
>>                 zero_data =
>>                         (struct file_zero_data_information
>> *)&req->Buffer[0];
>>
>> @@ -7490,6 +7529,11 @@ int smb2_ioctl(struct ksmbd_work *work)
>>                 break;
>>         }
>>         case FSCTL_QUERY_ALLOCATED_RANGES:
>> +               if (in_buf_len < sizeof(struct
>> file_allocated_range_buffer)) {
>> +                       ret = -EINVAL;
>> +                       goto out;
>> +               }
>> +
>>                 ret = fsctl_query_allocated_ranges(work, id,
>>                         (struct file_allocated_range_buffer
>> *)&req->Buffer[0],
>>                         (struct file_allocated_range_buffer
>> *)&rsp->Buffer[0],
>> @@ -7530,6 +7574,11 @@ int smb2_ioctl(struct ksmbd_work *work)
>>                 struct duplicate_extents_to_file *dup_ext;
>>                 loff_t src_off, dst_off, length, cloned;
>>
>> +               if (in_buf_len < sizeof(struct duplicate_extents_to_file))
>> {
>> +                       ret = -EINVAL;
>> +                       goto out;
>> +               }
>> +
>>                 dup_ext = (struct duplicate_extents_to_file
>> *)&req->Buffer[0];
>>
>>                 fp_in = ksmbd_lookup_fd_slow(work,
>> dup_ext->VolatileFileHandle,
>> --
>> 2.25.1
>>
>
>
> --
> Thanks,
> Hyunchul
>




[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux