[PATCH 1/2] ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA

[PATCH 1/2] ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA

[Namjae Jeon]

Smatch static checker warning:
 fs/ksmbd/smb2pdu.c:7759 smb2_ioctl()
 warn: no lower bound on 'off'

Fix unexpected result that could caused from negative off and bfz.

Fixes: b5e5f9dfc915 ("ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA")
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/ksmbd/smb2pdu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 81e987114206..b7a420e0fcc4 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -7757,7 +7757,7 @@ int smb2_ioctl(struct ksmbd_work *work)
 
 		off = le64_to_cpu(zero_data->FileOffset);
 		bfz = le64_to_cpu(zero_data->BeyondFinalZero);
-		if (off > bfz) {
+		if (off < 0 || bfz < 0 || off > bfz) {
 			ret = -EINVAL;
 			goto out;
 		}
-- 
2.25.1

[PATCH 2/2] ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES

[Namjae Jeon]

Smatch static checker warning:
 fs/ksmbd/vfs.c:1040 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'length'
 fs/ksmbd/vfs.c:1041 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'start'

Fix unexpected result that could caused from negative start and length.

Fixes: f44158485826 ("cifsd: add file operations")
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/ksmbd/smb2pdu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index b7a420e0fcc4..4af4230ab50b 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -7457,6 +7457,11 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id,
 	start = le64_to_cpu(qar_req->file_offset);
 	length = le64_to_cpu(qar_req->length);
 
+	if (start < 0 || length < 0) {
+		ksmbd_fd_put(work, fp);
+		return -EINVAL;
+	}
+
 	ret = ksmbd_vfs_fqar_lseek(fp, start, length,
 				   qar_rsp, in_count, out_count);
 	if (ret && ret != -E2BIG)
-- 
2.25.1

Re: [PATCH 2/2] ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES

[Sergey Senozhatsky]

On (23/03/05 21:34), Namjae Jeon wrote:
> +++ b/fs/ksmbd/smb2pdu.c
> @@ -7457,6 +7457,11 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id,
>  	start = le64_to_cpu(qar_req->file_offset);
>  	length = le64_to_cpu(qar_req->length);
>  
> +	if (start < 0 || length < 0) {
> +		ksmbd_fd_put(work, fp);
> +		return -EINVAL;
> +	}

Can we do sanity checking before we ksmbd_lookup_fd_fast()?

Re: [PATCH 2/2] ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES

[Namjae Jeon]

2023-03-07 13:09 GMT+09:00, Sergey Senozhatsky <senozhatsky@chromium.org>:
> On (23/03/05 21:34), Namjae Jeon wrote:
>> +++ b/fs/ksmbd/smb2pdu.c
>> @@ -7457,6 +7457,11 @@ static int fsctl_query_allocated_ranges(struct
>> ksmbd_work *work, u64 id,
>>  	start = le64_to_cpu(qar_req->file_offset);
>>  	length = le64_to_cpu(qar_req->length);
>>
>> +	if (start < 0 || length < 0) {
>> +		ksmbd_fd_put(work, fp);
>> +		return -EINVAL;
>> +	}
>
> Can we do sanity checking before we ksmbd_lookup_fd_fast()?
We can:), will update it on v2.

Thanks!
>

Re: [PATCH 1/2] ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA

[Sergey Senozhatsky]

On (23/03/05 21:34), Namjae Jeon wrote:
> Smatch static checker warning:
>  fs/ksmbd/smb2pdu.c:7759 smb2_ioctl()
>  warn: no lower bound on 'off'
> 
> Fix unexpected result that could caused from negative off and bfz.
> 
> Fixes: b5e5f9dfc915 ("ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA")
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>