* [PATCH] smb/client: fix possible infinite loop and oob read in symlink_data()
@ 2026-05-13 8:12 Ye Bin
2026-05-13 17:58 ` Steve French
0 siblings, 1 reply; 3+ messages in thread
From: Ye Bin @ 2026-05-13 8:12 UTC (permalink / raw)
To: sfrench, pc, ronniesahlberg, sprasad, linux-cifs, tom, bharathsm
Cc: samba-technical
On 32-bit architectures, the infinite loop is as follows:
len = p->ErrorDataLength == 0xfffffff8
u8 *next = p->ErrorContextData + len
next == p
On 32-bit architectures, the out-of-bounds read is as follows:
len = p->ErrorDataLength == 0xfffffff0
u8 *next = p->ErrorContextData + len
next == (u8 *)p - 8
Reported-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
Cc: stable@vger.kernel.org
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
fs/smb/client/smb2file.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c
index b292aa94a593..9d6f342b3f82 100644
--- a/fs/smb/client/smb2file.c
+++ b/fs/smb/client/smb2file.c
@@ -31,7 +31,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
u32 len;
if (err->ErrorContextCount) {
- struct smb2_error_context_rsp *p;
+ struct smb2_error_context_rsp *p, *next;
len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp,
ErrorContextData) +
@@ -49,7 +49,10 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
__func__, le32_to_cpu(p->ErrorId));
len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
- p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
+ next = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
+ if (next <= p)
+ return ERR_PTR(-EINVAL);
+ p = next;
}
} else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&
iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) {
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] smb/client: fix possible infinite loop and oob read in symlink_data()
2026-05-13 8:12 [PATCH] smb/client: fix possible infinite loop and oob read in symlink_data() Ye Bin
@ 2026-05-13 17:58 ` Steve French
2026-05-14 13:25 ` yebin
0 siblings, 1 reply; 3+ messages in thread
From: Steve French @ 2026-05-13 17:58 UTC (permalink / raw)
To: Ye Bin
Cc: sfrench, pc, ronniesahlberg, sprasad, linux-cifs, tom, bharathsm,
samba-technical
merged into cifs-2.6.git for-next
On Wed, May 13, 2026 at 3:15 AM Ye Bin <yebin10@huawei.com> wrote:
>
> On 32-bit architectures, the infinite loop is as follows:
>
> len = p->ErrorDataLength == 0xfffffff8
> u8 *next = p->ErrorContextData + len
> next == p
>
> On 32-bit architectures, the out-of-bounds read is as follows:
>
> len = p->ErrorDataLength == 0xfffffff0
> u8 *next = p->ErrorContextData + len
> next == (u8 *)p - 8
>
> Reported-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
> Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ye Bin <yebin10@huawei.com>
> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
> ---
> fs/smb/client/smb2file.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c
> index b292aa94a593..9d6f342b3f82 100644
> --- a/fs/smb/client/smb2file.c
> +++ b/fs/smb/client/smb2file.c
> @@ -31,7 +31,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
> u32 len;
>
> if (err->ErrorContextCount) {
> - struct smb2_error_context_rsp *p;
> + struct smb2_error_context_rsp *p, *next;
>
> len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp,
> ErrorContextData) +
> @@ -49,7 +49,10 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
> __func__, le32_to_cpu(p->ErrorId));
>
> len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
> - p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
> + next = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
> + if (next <= p)
> + return ERR_PTR(-EINVAL);
> + p = next;
> }
> } else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&
> iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) {
> --
> 2.34.1
>
>
--
Thanks,
Steve
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] smb/client: fix possible infinite loop and oob read in symlink_data()
2026-05-13 17:58 ` Steve French
@ 2026-05-14 13:25 ` yebin
0 siblings, 0 replies; 3+ messages in thread
From: yebin @ 2026-05-14 13:25 UTC (permalink / raw)
To: Steve French, Ye Bin
Cc: sfrench, pc, ronniesahlberg, sprasad, linux-cifs, tom, bharathsm,
samba-technical, chenxiaosong
Hi Steve,
I have simplified the patch according to the review comments from Sashiko
and sent the V2 version. Please pay attention to it.
On 2026/5/14 1:58, Steve French wrote:
> merged into cifs-2.6.git for-next
>
> On Wed, May 13, 2026 at 3:15 AM Ye Bin <yebin10@huawei.com> wrote:
>>
>> On 32-bit architectures, the infinite loop is as follows:
>>
>> len = p->ErrorDataLength == 0xfffffff8
>> u8 *next = p->ErrorContextData + len
>> next == p
>>
>> On 32-bit architectures, the out-of-bounds read is as follows:
>>
>> len = p->ErrorDataLength == 0xfffffff0
>> u8 *next = p->ErrorContextData + len
>> next == (u8 *)p - 8
>>
>> Reported-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
>> Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Ye Bin <yebin10@huawei.com>
>> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
>> ---
>> fs/smb/client/smb2file.c | 7 +++++--
>> 1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c
>> index b292aa94a593..9d6f342b3f82 100644
>> --- a/fs/smb/client/smb2file.c
>> +++ b/fs/smb/client/smb2file.c
>> @@ -31,7 +31,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
>> u32 len;
>>
>> if (err->ErrorContextCount) {
>> - struct smb2_error_context_rsp *p;
>> + struct smb2_error_context_rsp *p, *next;
>>
>> len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp,
>> ErrorContextData) +
>> @@ -49,7 +49,10 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
>> __func__, le32_to_cpu(p->ErrorId));
>>
>> len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
>> - p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
>> + next = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
>> + if (next <= p)
>> + return ERR_PTR(-EINVAL);
>> + p = next;
>> }
>> } else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&
>> iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) {
>> --
>> 2.34.1
>>
>>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-14 13:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-13 8:12 [PATCH] smb/client: fix possible infinite loop and oob read in symlink_data() Ye Bin
2026-05-13 17:58 ` Steve French
2026-05-14 13:25 ` yebin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox