From: Sergey Senozhatsky <senozhatsky@chromium.org>
To: HexRabbit <h3xrabbit@gmail.com>
Cc: linkinjeon@kernel.org, sfrench@samba.org,
senozhatsky@chromium.org, tom@talpey.com,
linux-cifs@vger.kernel.org
Subject: Re: [PATCH] ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
Date: Wed, 17 May 2023 20:05:05 +0900 [thread overview]
Message-ID: <20230517110505.GB20467@google.com> (raw)
In-Reply-To: <20230517095951.3476020-1-h3xrabbit@gmail.com>
On (23/05/17 09:59), HexRabbit wrote:
> [ 3350.990282] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x35d7/0x3e60
> [ 3350.990282] Read of size 2 at addr ffff88810ad61346 by task kworker/5:0/276
> [ 3351.000406] Workqueue: ksmbd-io handle_ksmbd_work
> [ 3351.003499] Call Trace:
> [ 3351.006473] <TASK>
> [ 3351.006473] dump_stack_lvl+0x8d/0xe0
> [ 3351.006473] print_report+0xcc/0x620
> [ 3351.006473] kasan_report+0x92/0xc0
> [ 3351.006473] smb2_handle_negotiate+0x35d7/0x3e60
> [ 3351.014760] ksmbd_smb_negotiate_common+0x7a7/0xf00
> [ 3351.014760] handle_ksmbd_work+0x3f7/0x12d0
> [ 3351.014760] process_one_work+0xa85/0x1780
[..]
> - if (req->DialectCount == 0) {
> - pr_err("malformed packet\n");
> + smb2_buf_len = get_rfc1002_len(work->request_buf);
> + smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects);
> + if (smb2_neg_size > smb2_buf_len) {
> rsp->hdr.Status = STATUS_INVALID_PARAMETER;
> rc = -EINVAL;
> goto err_out;
> }
>
> - smb2_buf_len = get_rfc1002_len(work->request_buf);
> - smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects);
> - if (smb2_neg_size > smb2_buf_len) {
> + if (req->DialectCount == 0) {
> + pr_err("malformed packet\n");
> rsp->hdr.Status = STATUS_INVALID_PARAMETER;
> rc = -EINVAL;
> goto err_out;
May I please ask where out-of-bounds access happens and how does
`smb2_neg_size > smb2_buf_len` fix it?
next prev parent reply other threads:[~2023-05-17 11:05 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-17 9:59 [PATCH] ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate HexRabbit
2023-05-17 10:17 ` Namjae Jeon
2023-05-17 11:02 ` Sergey Senozhatsky
2023-05-17 11:05 ` Sergey Senozhatsky [this message]
2023-05-17 11:13 ` Sergey Senozhatsky
[not found] ` <CAF3ZFef4gmEVZR5riwdB1bkB4CccziGw3g18cyz7Sim4xw+ZDw@mail.gmail.com>
2023-05-18 0:33 ` Sergey Senozhatsky
2023-05-18 8:43 ` Hex Rabbit
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230517110505.GB20467@google.com \
--to=senozhatsky@chromium.org \
--cc=h3xrabbit@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=sfrench@samba.org \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox