Patch "ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ksmbd-fix-slab-out-of-bounds-in-smb_strndup_from_utf16.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From d10c77873ba1e9e6b91905018e29e196fd5f863d Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Date: Wed, 20 Dec 2023 15:52:11 +0900
Subject: ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

From: Namjae Jeon <linkinjeon@xxxxxxxxxx>

commit d10c77873ba1e9e6b91905018e29e196fd5f863d upstream.

If ->NameOffset/Length is bigger than ->CreateContextsOffset/Length,
ksmbd_check_message doesn't validate request buffer it correctly.
So slab-out-of-bounds warning from calling smb_strndup_from_utf16()
in smb2_open() could happen. If ->NameLength is non-zero, Set the larger
of the two sums (Name and CreateContext size) as the offset and length of
the data area.

Reported-by: Yang Chaoming <lometsj@xxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 fs/ksmbd/smb2misc.c |   15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -107,16 +107,25 @@ static int smb2_get_data_area_len(unsign
 		break;
 	case SMB2_CREATE:
 	{
+		unsigned short int name_off =
+			le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
+		unsigned short int name_len =
+			le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
+
 		if (((struct smb2_create_req *)hdr)->CreateContextsLength) {
 			*off = le32_to_cpu(((struct smb2_create_req *)
 				hdr)->CreateContextsOffset);
 			*len = le32_to_cpu(((struct smb2_create_req *)
 				hdr)->CreateContextsLength);
-			break;
+			if (!name_len)
+				break;
+
+			if (name_off + name_len < (u64)*off + *len)
+				break;
 		}
 
-		*off = le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
-		*len = le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
+		*off = name_off;
+		*len = name_len;
 		break;
 	}
 	case SMB2_QUERY_INFO:


Patches currently in stable-queue which might be from linkinjeon@xxxxxxxxxx are

queue-5.15/ksmbd-fix-wrong-allocation-size-update-in-smb2_open.patch
queue-5.15/ksmbd-avoid-duplicate-opinfo_put-call-on-error-of-sm.patch
queue-5.15/ksmbd-send-v2-lease-break-notification-for-directory.patch
queue-5.15/ksmbd-set-v2-lease-capability.patch
queue-5.15/ksmbd-fix-wrong-name-of-smb2_create_allocation_size.patch
queue-5.15/ksmbd-downgrade-rwh-lease-caching-state-to-rh-for-di.patch
queue-5.15/ksmbd-set-epoch-in-create-context-v2-lease.patch
queue-5.15/ksmbd-fix-slab-out-of-bounds-in-smb_strndup_from_utf16.patch
queue-5.15/ksmbd-have-a-dependency-on-cifs-arc4.patch
queue-5.15/ksmbd-lazy-v2-lease-break-on-smb2_write.patch




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux