From: Frank Sorenson <sorenson@redhat.com>
To: linux-cifs@vger.kernel.org, pc@manguebit.org
Cc: linkinjeon@kernel.org, ronniesahlberg@gmail.com,
sprasad@microsoft.com, tom@talpey.com, bharathsm@microsoft.com,
stable@vger.kernel.org
Subject: [PATCH v4 04/10] smb: client: fix missing lower-bound check on DFS referral string offsets
Date: Sun, 13 Sep 2026 16:45:02 -0500 [thread overview]
Message-ID: <20260913214510.3071370-5-sorenson@redhat.com> (raw)
In-Reply-To: <20260913214510.3071370-1-sorenson@redhat.com>
parse_dfs_referrals() checks that DfsPathOffset and NetworkAddressOffset
do not exceed the buffer end, but fails to check that they don't point
inside the referral header itself.
If a server provides an offset smaller than sizeof(struct dfs_referral_level_3),
the derived string pointer overlaps with the struct fields, causing
cifs_strndup_from_utf16() to interpret header data as UTF-16 strings.
Fix this by enforcing that string offsets are at least sizeof(*ref).
Fixes: 4ecce920e13a ("CIFS: move DFS response parsing out of SMB1 code")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
---
fs/smb/client/misc.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c
index 945194fe7a97..05168284f205 100644
--- a/fs/smb/client/misc.c
+++ b/fs/smb/client/misc.c
@@ -788,7 +788,11 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,
node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags);
/* copy DfsPath */
- if (le16_to_cpu(ref->DfsPathOffset) > data_end - (char *)ref) {
+ if (le16_to_cpu(ref->DfsPathOffset) < sizeof(*ref) ||
+ le16_to_cpu(ref->DfsPathOffset) > data_end - (char *)ref) {
+ cifs_dbg(VFS, "%s: DfsPathOffset %u out of range [%zu, %td]\n",
+ __func__, le16_to_cpu(ref->DfsPathOffset),
+ sizeof(*ref), data_end - (char *)ref);
rc = -EINVAL;
goto parse_DFS_referrals_exit;
}
@@ -802,7 +806,11 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,
}
/* copy link target UNC */
- if (le16_to_cpu(ref->NetworkAddressOffset) > data_end - (char *)ref) {
+ if (le16_to_cpu(ref->NetworkAddressOffset) < sizeof(*ref) ||
+ le16_to_cpu(ref->NetworkAddressOffset) > data_end - (char *)ref) {
+ cifs_dbg(VFS, "%s: NetworkAddressOffset %u out of range [%zu, %td]\n",
+ __func__, le16_to_cpu(ref->NetworkAddressOffset),
+ sizeof(*ref), data_end - (char *)ref);
rc = -EINVAL;
goto parse_DFS_referrals_exit;
}
--
2.55.0
next prev parent reply other threads:[~2026-09-13 21:45 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-13 21:44 [PATCH v4 00/10] smb: client: fix OOB reads and UAFs in SMB2/3 receive paths Frank Sorenson
2026-09-13 21:44 ` [PATCH v4 01/10] smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Frank Sorenson
2026-09-13 21:45 ` [PATCH v4 02/10] smb: client: validate minimum PDU size before smb2_get_data_area_len() Frank Sorenson
2026-09-13 21:45 ` [PATCH v4 03/10] smb: client: fix server->total_read for compound encrypted PDUs Frank Sorenson
2026-09-13 21:45 ` Frank Sorenson [this message]
2026-09-13 21:45 ` [PATCH v4 05/10] smb: client: reject short Next offsets in parse_server_interfaces() Frank Sorenson
2026-09-13 21:45 ` [PATCH v4 06/10] smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() Frank Sorenson
2026-09-13 21:45 ` [PATCH v4 07/10] smb: client: fix missing iov bounds check in parse_posix_sids() Frank Sorenson
2026-09-13 21:45 ` [PATCH v4 08/10] smb: client: fix underflow in is_valid_oplock_break() notify offset check Frank Sorenson
2026-09-13 21:45 ` [PATCH v4 09/10] smb: client: fix potential OOB read in smb3_enum_snapshots() Frank Sorenson
2026-09-13 21:45 ` [PATCH v4 10/10] smb: client: fix reparse buffer bounds in cifs_query_reparse_point() Frank Sorenson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260913214510.3071370-5-sorenson@redhat.com \
--to=sorenson@redhat.com \
--cc=bharathsm@microsoft.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=pc@manguebit.org \
--cc=ronniesahlberg@gmail.com \
--cc=sprasad@microsoft.com \
--cc=stable@vger.kernel.org \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox