[PATCH v4 09/10] smb: client: fix potential OOB read in smb3_enum_snapshots()

[Frank Sorenson <sorenson@redhat.com>]

If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots()
sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying
the actual length of the server's reply.

Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount
and allocates retbuf to exactly that length, a short reply results in
ret_data_len exceeding the size of retbuf. The subsequent copy_to_user()
then reads past the end of retbuf, leaking adjacent slab memory to userspace.
The subsequent clamp check is ineffective as it only reduces ret_data_len.

Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array)
with -EIO. Note that the bound is set to the 12-byte struct size rather than
the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because
12 bytes is exactly what copy_to_user() attempts to read to ensure memory
safety.

Fixes: e02789a53d71 ("smb3: enumerating snapshots was leaving part of the data off end")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
---
 fs/smb/client/smb2ops.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index ee3c98e3f316..3464470d3297 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -2463,8 +2463,14 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon,
 		 * and retry the ioctl again with larger array size sufficient
 		 * to hold all of the snapshot GMT tokens on the second try.
 		 */
-		if (snapshot_in.snapshot_array_size < GMT_TOKEN_SIZE)
+		if (snapshot_in.snapshot_array_size < GMT_TOKEN_SIZE) {
+			if (ret_data_len < sizeof(struct smb_snapshot_array)) {
+				rc = -EIO;
+				kfree(retbuf);
+				return rc;
+			}
 			ret_data_len = sizeof(struct smb_snapshot_array);
+		}
 
 		/*
 		 * We return struct SRV_SNAPSHOT_ARRAY, followed by
-- 
2.55.0