From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 171BB182C2 for ; Mon, 18 Dec 2023 10:38:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="DDEEg9Bm" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36BBAC433C9; Mon, 18 Dec 2023 10:38:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1702895908; bh=H3PZJ4mJ8TS8cqrxTBlve6asYlZPXQiuH4ihuHnSoXg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DDEEg9BmqOXgNCjVFBEAVGNAPX4J5El4kQ4uqbo/AefcAw66xawC+eQquvYkoUhUF 9gM5FACvklhn3L6ecsGJUEZ1okE/zIcE6zutU1eXa9Uks/lhrRnSy7VhHG/4DJJQjK O8tmzjfsANyIPsdKv3l49YcRrNUelyi+GYmMTldY= Date: Mon, 18 Dec 2023 11:38:25 +0100 From: Greg KH To: paul.gortmaker@windriver.com Cc: Namjae Jeon , Steve French , stable@vger.kernel.org Subject: Re: [PATCH 1/1] ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop Message-ID: <2023121813-compactor-lettuce-4ced@gregkh> References: <20231212184745.2245187-1-paul.gortmaker@windriver.com> <20231212184745.2245187-2-paul.gortmaker@windriver.com> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231212184745.2245187-2-paul.gortmaker@windriver.com> On Tue, Dec 12, 2023 at 01:47:45PM -0500, paul.gortmaker@windriver.com wrote: > From: Namjae Jeon > > commit 368ba06881c395f1c9a7ba22203cf8d78b4addc0 upstream. > > The length field of netbios header must be greater than the SMB header > sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet. > > If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`. > In the function `get_smb2_cmd_val` ksmbd will read cmd from > `rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN > detector to print the following error message: > > [ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60 > [ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task ksmbd:42632/248 > ... > [ 7.207125] > [ 7.209191] get_smb2_cmd_val+0x45/0x60 > [ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100 > [ 7.209712] ksmbd_server_process_request+0x72/0x160 > [ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550 > [ 7.212280] kthread+0x160/0x190 > [ 7.212762] ret_from_fork+0x1f/0x30 > [ 7.212981] > > Cc: stable@vger.kernel.org > Reported-by: Chih-Yen Chang > Signed-off-by: Namjae Jeon > Signed-off-by: Steve French > [PG: fs/smb/server/connection.c --> fs/ksmbd/connection.c for v5.15. > Also no smb2_get_msg() as no +4 from cb4517201b8a in v5.15 baseline.] > Signed-off-by: Paul Gortmaker > --- > fs/ksmbd/connection.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) Now queued up, thanks. greg k-h