From: Frank Sorenson <sorenson@redhat.com>
To: linux-cifs@vger.kernel.org
Cc: pc@manguebit.org, linkinjeon@kernel.org, stable@vger.kernel.org
Subject: [PATCH 04/11] smb: client: fix missing lower-bound check on DFS referral string offsets
Date: Sun, 23 Aug 2026 13:58:00 -0500 [thread overview]
Message-ID: <20260823185807.3115901-5-sorenson@redhat.com> (raw)
In-Reply-To: <20260823185807.3115901-1-sorenson@redhat.com>
parse_dfs_referrals() checks DfsPathOffset and NetworkAddressOffset
against the buffer end but not against sizeof(*ref). An offset smaller
than sizeof(struct dfs_referral_level_3) places the derived pointer
inside the referral header, causing cifs_strndup_from_utf16() to read
struct fields as string data.
Require each offset to be at least sizeof(*ref).
Fixes: 4ecce920e13a ("CIFS: move DFS response parsing out of SMB1 code")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
---
fs/smb/client/misc.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c
index 46e1382e8e04..bc7cccebf387 100644
--- a/fs/smb/client/misc.c
+++ b/fs/smb/client/misc.c
@@ -787,7 +787,11 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,
node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags);
/* copy DfsPath */
- if (le16_to_cpu(ref->DfsPathOffset) > data_end - (char *)ref) {
+ if (le16_to_cpu(ref->DfsPathOffset) < sizeof(*ref) ||
+ le16_to_cpu(ref->DfsPathOffset) > data_end - (char *)ref) {
+ cifs_dbg(VFS, "%s: DfsPathOffset %u out of range [%zu, %td]\n",
+ __func__, le16_to_cpu(ref->DfsPathOffset),
+ sizeof(*ref), data_end - (char *)ref);
rc = -EINVAL;
goto parse_DFS_referrals_exit;
}
@@ -801,7 +805,11 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,
}
/* copy link target UNC */
- if (le16_to_cpu(ref->NetworkAddressOffset) > data_end - (char *)ref) {
+ if (le16_to_cpu(ref->NetworkAddressOffset) < sizeof(*ref) ||
+ le16_to_cpu(ref->NetworkAddressOffset) > data_end - (char *)ref) {
+ cifs_dbg(VFS, "%s: NetworkAddressOffset %u out of range [%zu, %td]\n",
+ __func__, le16_to_cpu(ref->NetworkAddressOffset),
+ sizeof(*ref), data_end - (char *)ref);
rc = -EINVAL;
goto parse_DFS_referrals_exit;
}
--
2.55.0
next prev parent reply other threads:[~2026-08-23 18:58 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-23 18:57 [PATCH 00/11] smb: client: fix OOB reads and UAFs in SMB2/3 receive paths Frank Sorenson
2026-08-23 18:57 ` [PATCH 01/11] smb: client: fix NextCommand bounds and aliasing UAF in receive_encrypted_standard() Frank Sorenson
2026-08-23 18:57 ` [PATCH 02/11] smb: client: validate PDU length before smb2_get_data_area_len() struct access Frank Sorenson
2026-08-23 18:57 ` [PATCH 03/11] smb: client: fix server->total_read not tracking sub-PDU size in receive_encrypted_standard() Frank Sorenson
2026-08-23 18:58 ` Frank Sorenson [this message]
2026-08-23 18:58 ` [PATCH 05/11] smb: client: fix missing lower-bound on Next field in parse_server_interfaces() Frank Sorenson
2026-08-23 18:58 ` [PATCH 06/11] smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() Frank Sorenson
2026-08-25 22:13 ` [PATCH v2] " Frank Sorenson
2026-08-26 0:59 ` Namjae Jeon
2026-08-23 18:58 ` [PATCH 07/11] smb: client: fix missing iov bounds check in parse_posix_sids() Frank Sorenson
2026-08-23 18:58 ` [PATCH 08/11] smb: client: fix underflow in is_valid_oplock_break() notify offset check Frank Sorenson
2026-08-23 18:58 ` [PATCH 09/11] smb: client: fix potential OOB read in smb3_enum_snapshots() Frank Sorenson
2026-08-23 18:58 ` [PATCH 10/11] smb: client: fix incomplete bounds check on reparse buffer in cifs_query_reparse_point() Frank Sorenson
2026-08-23 18:58 ` [PATCH 11/11] smb: client: fix NameOffset and Next field validation in smb2_parse_contexts() Frank Sorenson
2026-08-25 23:54 ` [PATCH 00/11] smb: client: fix OOB reads and UAFs in SMB2/3 receive paths Yunseong Kim
2026-08-26 2:18 ` Frank Sorenson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260823185807.3115901-5-sorenson@redhat.com \
--to=sorenson@redhat.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=pc@manguebit.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox