From: Sergey Senozhatsky <senozhatsky@chromium.org>
To: Namjae Jeon <linkinjeon@kernel.org>
Cc: linux-cifs@vger.kernel.org, smfrench@gmail.com,
senozhatsky@chromium.org, tom@talpey.com,
atteh.mailbox@gmail.com, Pumpkin <cc85nod@gmail.com>
Subject: Re: [PATCH 2/6] ksmbd: fix wrong UserName check in session_user
Date: Sat, 6 May 2023 12:10:39 +0900 [thread overview]
Message-ID: <20230506031039.GD3281499@google.com> (raw)
In-Reply-To: <20230505151108.5911-2-linkinjeon@kernel.org>
On (23/05/06 00:11), Namjae Jeon wrote:
> The offset of UserName is related to the address of security
> buffer. To ensure the validaty of UserName, we need to compare name_off
> + name_len with secbuf_len instead of auth_msg_len.
>
> [ 27.096243] ==================================================================
> [ 27.096890] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x188/0x350
> [ 27.097609] Read of size 2 at addr ffff888005e3b542 by task kworker/0:0/7
> ...
> [ 27.099950] Call Trace:
> [ 27.100194] <TASK>
> [ 27.100397] dump_stack_lvl+0x33/0x50
> [ 27.100752] print_report+0xcc/0x620
> [ 27.102305] kasan_report+0xae/0xe0
> [ 27.103072] kasan_check_range+0x35/0x1b0
> [ 27.103757] smb_strndup_from_utf16+0x188/0x350
> [ 27.105474] smb2_sess_setup+0xaf8/0x19c0
> [ 27.107935] handle_ksmbd_work+0x274/0x810
> [ 27.108315] process_one_work+0x419/0x760
> [ 27.108689] worker_thread+0x2a2/0x6f0
> [ 27.109385] kthread+0x160/0x190
> [ 27.110129] ret_from_fork+0x1f/0x30
> [ 27.110454] </TASK>
>
> Signed-off-by: Pumpkin <cc85nod@gmail.com>
Do we still have a requirement that there should be a real name in SoB?
next prev parent reply other threads:[~2023-05-06 3:10 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-05 15:11 [PATCH 1/6] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Namjae Jeon
2023-05-05 15:11 ` [PATCH 2/6] ksmbd: fix wrong UserName check in session_user Namjae Jeon
2023-05-06 3:10 ` Sergey Senozhatsky [this message]
2023-05-07 0:52 ` Namjae Jeon
2023-05-05 15:11 ` [PATCH 3/6] ksmbd: allocate one more byte for implied bcc[0] Namjae Jeon
2023-05-05 15:11 ` [PATCH 4/6] ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon
2023-05-05 15:11 ` [PATCH 5/6] ksmbd: remove unused ksmbd_tree_conn_share function Namjae Jeon
2023-05-08 1:07 ` Sergey Senozhatsky
2023-05-05 15:11 ` [PATCH 6/6] ksmbd: use kzalloc() instead of __GFP_ZERO Namjae Jeon
2023-05-08 1:06 ` Sergey Senozhatsky
2023-05-08 1:05 ` [PATCH 1/6] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Sergey Senozhatsky
2023-05-08 12:58 ` Namjae Jeon
2023-05-09 3:05 ` Sergey Senozhatsky
[not found] ` <CAAn9K_vRCOtYZXRBDKY4GzPA-TyrQ_Zh-qssu51Vr6sTwg5w4w@mail.gmail.com>
2023-05-12 14:14 ` Namjae Jeon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230506031039.GD3281499@google.com \
--to=senozhatsky@chromium.org \
--cc=atteh.mailbox@gmail.com \
--cc=cc85nod@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=smfrench@gmail.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.