From: Sergey Senozhatsky <senozhatsky@chromium.org>
To: Namjae Jeon <linkinjeon@kernel.org>
Cc: linux-cifs@vger.kernel.org, smfrench@gmail.com,
senozhatsky@chromium.org, tom@talpey.com,
atteh.mailbox@gmail.com, Pumpkin <cc85nod@gmail.com>
Subject: Re: [PATCH 2/6] ksmbd: fix wrong UserName check in session_user
Date: Sat, 6 May 2023 12:10:39 +0900 [thread overview]
Message-ID: <20230506031039.GD3281499@google.com> (raw)
In-Reply-To: <20230505151108.5911-2-linkinjeon@kernel.org>
On (23/05/06 00:11), Namjae Jeon wrote:
> The offset of UserName is related to the address of security
> buffer. To ensure the validaty of UserName, we need to compare name_off
> + name_len with secbuf_len instead of auth_msg_len.
>
> [ 27.096243] ==================================================================
> [ 27.096890] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x188/0x350
> [ 27.097609] Read of size 2 at addr ffff888005e3b542 by task kworker/0:0/7
> ...
> [ 27.099950] Call Trace:
> [ 27.100194] <TASK>
> [ 27.100397] dump_stack_lvl+0x33/0x50
> [ 27.100752] print_report+0xcc/0x620
> [ 27.102305] kasan_report+0xae/0xe0
> [ 27.103072] kasan_check_range+0x35/0x1b0
> [ 27.103757] smb_strndup_from_utf16+0x188/0x350
> [ 27.105474] smb2_sess_setup+0xaf8/0x19c0
> [ 27.107935] handle_ksmbd_work+0x274/0x810
> [ 27.108315] process_one_work+0x419/0x760
> [ 27.108689] worker_thread+0x2a2/0x6f0
> [ 27.109385] kthread+0x160/0x190
> [ 27.110129] ret_from_fork+0x1f/0x30
> [ 27.110454] </TASK>
>
> Signed-off-by: Pumpkin <cc85nod@gmail.com>
Do we still have a requirement that there should be a real name in SoB?
next prev parent reply other threads:[~2023-05-06 3:10 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-05 15:11 [PATCH 1/6] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Namjae Jeon
2023-05-05 15:11 ` [PATCH 2/6] ksmbd: fix wrong UserName check in session_user Namjae Jeon
2023-05-06 3:10 ` Sergey Senozhatsky [this message]
2023-05-07 0:52 ` Namjae Jeon
2023-05-05 15:11 ` [PATCH 3/6] ksmbd: allocate one more byte for implied bcc[0] Namjae Jeon
2023-05-05 15:11 ` [PATCH 4/6] ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon
2023-05-05 15:11 ` [PATCH 5/6] ksmbd: remove unused ksmbd_tree_conn_share function Namjae Jeon
2023-05-08 1:07 ` Sergey Senozhatsky
2023-05-05 15:11 ` [PATCH 6/6] ksmbd: use kzalloc() instead of __GFP_ZERO Namjae Jeon
2023-05-08 1:06 ` Sergey Senozhatsky
2023-05-08 1:05 ` [PATCH 1/6] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Sergey Senozhatsky
2023-05-08 12:58 ` Namjae Jeon
2023-05-09 3:05 ` Sergey Senozhatsky
[not found] ` <CAAn9K_vRCOtYZXRBDKY4GzPA-TyrQ_Zh-qssu51Vr6sTwg5w4w@mail.gmail.com>
2023-05-12 14:14 ` Namjae Jeon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230506031039.GD3281499@google.com \
--to=senozhatsky@chromium.org \
--cc=atteh.mailbox@gmail.com \
--cc=cc85nod@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=smfrench@gmail.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox