Re: [PATCH 1/1] ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Dec 18, 2023 at 08:28:17PM +0900, Namjae Jeon wrote:
> 2023-12-18 19:38 GMT+09:00, Greg KH <gregkh@linuxfoundation.org>:
> > On Tue, Dec 12, 2023 at 01:47:45PM -0500, paul.gortmaker@windriver.com
> > wrote:
> >> From: Namjae Jeon <linkinjeon@kernel.org>
> >>
> >> commit 368ba06881c395f1c9a7ba22203cf8d78b4addc0 upstream.
> >>
> >> The length field of netbios header must be greater than the SMB header
> >> sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB
> >> packet.
> >>
> >> If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to
> >> `conn->request_buf`.
> >> In the function `get_smb2_cmd_val` ksmbd will read cmd from
> >> `rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN
> >> detector to print the following error message:
> >>
> >> [    7.205018] BUG: KASAN: slab-out-of-bounds in
> >> get_smb2_cmd_val+0x45/0x60
> >> [    7.205423] Read of size 2 at addr ffff8880062d8b50 by task
> >> ksmbd:42632/248
> >> ...
> >> [    7.207125]  <TASK>
> >> [    7.209191]  get_smb2_cmd_val+0x45/0x60
> >> [    7.209426]  ksmbd_conn_enqueue_request+0x3a/0x100
> >> [    7.209712]  ksmbd_server_process_request+0x72/0x160
> >> [    7.210295]  ksmbd_conn_handler_loop+0x30c/0x550
> >> [    7.212280]  kthread+0x160/0x190
> >> [    7.212762]  ret_from_fork+0x1f/0x30
> >> [    7.212981]  </TASK>
> >>
> >> Cc: stable@vger.kernel.org
> >> Reported-by: Chih-Yen Chang <cc85nod@gmail.com>
> >> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
> >> Signed-off-by: Steve French <stfrench@microsoft.com>
> >> [PG: fs/smb/server/connection.c --> fs/ksmbd/connection.c for v5.15.
> >>  Also no smb2_get_msg() as no +4 from cb4517201b8a in v5.15 baseline.]
> >> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> >> ---
> >>  fs/ksmbd/connection.c | 12 ++++++++++++
> >>  1 file changed, 12 insertions(+)
> >
> > Now queued up, thanks.
> Could you please remove this patch in your queue ?
> This patches in my ksmbd backport queue and Since I have backported
> all patches(between 5.16 ~ 6.7-rc1), I included original patch that do
> not need to be changed unlike this patch.
> 
> https://github.com/namjaejeon/stable-linux-5.15-ksmbd
> 
> I am testing them before sending it. I plan to send all patches within
> this week.

Sure, will drop it now, thanks.

greg k-h