Good catch. updated cifs-2.6.git for-next with this patch and added Cc: stable On Fri, Dec 15, 2023 at 4:59 PM Paulo Alcantara <pc@xxxxxxxxxxxxx> wrote: > > Validate @smb->WordCount to avoid reading off the end of @smb and thus > causing the following KASAN splat: > > BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs] > Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328 > > CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9 > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS > rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 > Call Trace: > <TASK> > dump_stack_lvl+0x4a/0x80 > print_report+0xcf/0x650 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? __phys_addr+0x46/0x90 > kasan_report+0xd8/0x110 > ? smbCalcSize+0x32/0x40 [cifs] > ? smbCalcSize+0x32/0x40 [cifs] > kasan_check_range+0x105/0x1b0 > smbCalcSize+0x32/0x40 [cifs] > checkSMB+0x162/0x370 [cifs] > ? __pfx_checkSMB+0x10/0x10 [cifs] > cifs_handle_standard+0xbc/0x2f0 [cifs] > ? srso_alias_return_thunk+0x5/0xfbef5 > cifs_demultiplex_thread+0xed1/0x1360 [cifs] > ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] > ? srso_alias_return_thunk+0x5/0xfbef5 > ? lockdep_hardirqs_on_prepare+0x136/0x210 > ? __pfx_lock_release+0x10/0x10 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? mark_held_locks+0x1a/0x90 > ? lockdep_hardirqs_on_prepare+0x136/0x210 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? __kthread_parkme+0xce/0xf0 > ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] > kthread+0x18d/0x1d0 > ? kthread+0xdb/0x1d0 > ? __pfx_kthread+0x10/0x10 > ret_from_fork+0x34/0x60 > ? __pfx_kthread+0x10/0x10 > ret_from_fork_asm+0x1b/0x30 > </TASK> > > This fixes CVE-2023-6606. > > Reported-by: j51569436@xxxxxxxxx > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218 > Signed-off-by: Paulo Alcantara (SUSE) <pc@xxxxxxxxxxxxx> > --- > fs/smb/client/misc.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c > index 35b176457bbe..c2137ea3c253 100644 > --- a/fs/smb/client/misc.c > +++ b/fs/smb/client/misc.c > @@ -363,6 +363,10 @@ checkSMB(char *buf, unsigned int total_read, struct TCP_Server_Info *server) > cifs_dbg(VFS, "Length less than smb header size\n"); > } > return -EIO; > + } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { > + cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", > + __func__, smb->WordCount); > + return -EIO; > } > > /* otherwise, there is enough to get to the BCC */ > -- > 2.43.0 > -- Thanks, Steve
