2023-12-13 3:47 GMT+09:00, paul.gortmaker@xxxxxxxxxxxxx <paul.gortmaker@xxxxxxxxxxxxx>: > From: Namjae Jeon <linkinjeon@xxxxxxxxxx> > > commit 368ba06881c395f1c9a7ba22203cf8d78b4addc0 upstream. > > The length field of netbios header must be greater than the SMB header > sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet. > > If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`. > In the function `get_smb2_cmd_val` ksmbd will read cmd from > `rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN > detector to print the following error message: > > [ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60 > [ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task > ksmbd:42632/248 > ... > [ 7.207125] <TASK> > [ 7.209191] get_smb2_cmd_val+0x45/0x60 > [ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100 > [ 7.209712] ksmbd_server_process_request+0x72/0x160 > [ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550 > [ 7.212280] kthread+0x160/0x190 > [ 7.212762] ret_from_fork+0x1f/0x30 > [ 7.212981] </TASK> > > Cc: stable@xxxxxxxxxxxxxxx > Reported-by: Chih-Yen Chang <cc85nod@xxxxxxxxx> > Signed-off-by: Namjae Jeon <linkinjeon@xxxxxxxxxx> > Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx> > [PG: fs/smb/server/connection.c --> fs/ksmbd/connection.c for v5.15. > Also no smb2_get_msg() as no +4 from cb4517201b8a in v5.15 baseline.] > Signed-off-by: Paul Gortmaker <paul.gortmaker@xxxxxxxxxxxxx> Looks good to me:) Thanks for your work!
