From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C2423CCFD2 for ; Mon, 7 Sep 2026 13:51:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788789103; cv=none; b=qzJOwrMYCWssnPUcfJqrQyPuBMAsZaJkuiWhrl1+/S2yCZFozSnen0BUKbNUMKKm2FmU12CdvrN8sRsIlxpxuHxaeswi8pRtz7D4vsP8E5VKzCJ8QgaG5OgC/TvM45Gnd0e+9e12PjSHJ5pfJ2LhOBKszkhwjOuf/8oVLJbIdHA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788789103; c=relaxed/simple; bh=p29FPLUCHvLKYRHCtfb1QKBEC2Nl2Rsrlc3N7qmKJI8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nijLqMZWlTL09LJ/x9W4WgSK87VyPtSLccfavM0Kdt6my4vgZBuZEW3IB55E+JvCHfhKk/FhkVXmXhw0PKep5a/eeTkwI86bAZz91kUhqrXPdSgCYEcMl7EPQbLm8WKLd97hF16yW2TqOXW7RIF6imz8mkzUHsC1SRuAC5TXI/U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QBIzPwQf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QBIzPwQf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 167E11F00A3D; Mon, 7 Sep 2026 13:51:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788789101; bh=4BUQBqIwzJqDNtOQRDloJy2zG94W2h6CqBMV8MieK+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QBIzPwQfmzQ6Okd+/ZXLveCBkEdmICNn2xiZxFRJBH+8whAFWKyPnIOokPfzpSDD2 bz3tzVeJjh67mnIsFHxa7xCKp3f0+HUHlJuJnS6H4urLJy+5JUT2JfzMeLVkZX5muk akYco1DA0l3Kk1c9e8s3jkBAb39ZQsJzZUzgHlpcUJRRapEGHH/zyaLWpq+XiE49n4 XAtl/lTjKULgFesYbUW2hFIH2UC3+ptEZnoaNlrS6fgd7WwXNFLCg5KT/SbXZiA2rs imHEsoeevhQUKK5ggeBUPRiMtKY3KJutexdm/hQbKhabVwkZ/sLKdjz1IQdDtHK2xN SzZbhJ5c6OEVA== From: Sasha Levin To: stable@vger.kernel.org Cc: Frank Sorenson , Shen Yongchao , Namjae Jeon , Paulo Alcantara , Sasha Levin Subject: [PATCH 6.12.y] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Date: Mon, 7 Sep 2026 09:51:39 -0400 Message-ID: <20260907135139.3105244-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026090302-baboon-occupy-7143@gregkh> References: <2026090302-baboon-occupy-7143@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Frank Sorenson [ Upstream commit 6343c1da561962688f203362d80d6a3bfa39fa1b ] coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified. Fixes: e4eb295d38b5 ("[PATCH] cifs: Handle multiple response transact2 part 1 of 2") Cc: stable@vger.kernel.org Reported-by: Shen Yongchao Signed-off-by: Frank Sorenson Signed-off-by: Namjae Jeon Signed-off-by: Paulo Alcantara [ transplanted the bounds validation to coalesce_t2() in smb1ops.c due to code relocation ] Signed-off-by: Sasha Levin --- fs/smb/client/smb1ops.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c index 4670c3e451a75..2d9b7e969614b 100644 --- a/fs/smb/client/smb1ops.c +++ b/fs/smb/client/smb1ops.c @@ -325,12 +325,31 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); - /* validate target area */ data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; + /* + * DataOffset fields are server-supplied and not validated against + * buffer bounds; check both data pointers before mutating the + * target header. + */ + if (data_area_of_tgt < (char *)target_hdr + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_tgt + total_in_src > + (char *)target_hdr + CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { + cifs_dbg(VFS, "%s: target data area out of bounds\n", __func__); + return -EPROTO; + } + if (data_area_of_src < second_buf + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_src + total_in_src > + second_buf + smbCalcSize((struct smb_hdr *)second_buf)) { + cifs_dbg(VFS, "%s: secondary data area out of bounds\n", __func__); + return -EPROTO; + } + total_in_tgt += total_in_src; /* is the result too big for the field? */ if (total_in_tgt > USHRT_MAX) { -- 2.53.0