FAILED: patch "[PATCH] ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()" failed to apply to 5.15-stable tree

FAILED: patch "[PATCH] ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()" failed to apply to 5.15-stable tree

[gregkh]

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x d10c77873ba1e9e6b91905018e29e196fd5f863d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024010241-define-gangly-9bf9@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..

Possible dependencies:

d10c77873ba1 ("ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From d10c77873ba1e9e6b91905018e29e196fd5f863d Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Wed, 20 Dec 2023 15:52:11 +0900
Subject: [PATCH] ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

If ->NameOffset/Length is bigger than ->CreateContextsOffset/Length,
ksmbd_check_message doesn't validate request buffer it correctly.
So slab-out-of-bounds warning from calling smb_strndup_from_utf16()
in smb2_open() could happen. If ->NameLength is non-zero, Set the larger
of the two sums (Name and CreateContext size) as the offset and length of
the data area.

Reported-by: Yang Chaoming <lometsj@live.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2misc.c b/fs/smb/server/smb2misc.c
index 23bd3d1209df..03dded29a980 100644
--- a/fs/smb/server/smb2misc.c
+++ b/fs/smb/server/smb2misc.c
@@ -106,16 +106,25 @@ static int smb2_get_data_area_len(unsigned int *off, unsigned int *len,
 		break;
 	case SMB2_CREATE:
 	{
+		unsigned short int name_off =
+			le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
+		unsigned short int name_len =
+			le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
+
 		if (((struct smb2_create_req *)hdr)->CreateContextsLength) {
 			*off = le32_to_cpu(((struct smb2_create_req *)
 				hdr)->CreateContextsOffset);
 			*len = le32_to_cpu(((struct smb2_create_req *)
 				hdr)->CreateContextsLength);
-			break;
+			if (!name_len)
+				break;
+
+			if (name_off + name_len < (u64)*off + *len)
+				break;
 		}
 
-		*off = le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
-		*len = le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
+		*off = name_off;
+		*len = name_len;
 		break;
 	}
 	case SMB2_QUERY_INFO:

Re: FAILED: patch "[PATCH] ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()" failed to apply to 5.15-stable tree

[Namjae Jeon]

2024-01-02 23:28 GMT+09:00, gregkh@linuxfoundation.org
<gregkh@linuxfoundation.org>:
>
> The patch below does not apply to the 5.15-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
I will send a backport patch for this today.
Thank you!
>
> To reproduce the conflict and resubmit, you may use the following commands:
>
> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
> linux-5.15.y
> git checkout FETCH_HEAD
> git cherry-pick -x d10c77873ba1e9e6b91905018e29e196fd5f863d
> # <resolve conflicts, build, test, etc.>
> git commit -s
> git send-email --to '<stable@vger.kernel.org>' --in-reply-to
> '2024010241-define-gangly-9bf9@gregkh' --subject-prefix 'PATCH 5.15.y'
> HEAD^..
>
> Possible dependencies:
>
> d10c77873ba1 ("ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()")
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
> From d10c77873ba1e9e6b91905018e29e196fd5f863d Mon Sep 17 00:00:00 2001
> From: Namjae Jeon <linkinjeon@kernel.org>
> Date: Wed, 20 Dec 2023 15:52:11 +0900
> Subject: [PATCH] ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
>
> If ->NameOffset/Length is bigger than ->CreateContextsOffset/Length,
> ksmbd_check_message doesn't validate request buffer it correctly.
> So slab-out-of-bounds warning from calling smb_strndup_from_utf16()
> in smb2_open() could happen. If ->NameLength is non-zero, Set the larger
> of the two sums (Name and CreateContext size) as the offset and length of
> the data area.
>
> Reported-by: Yang Chaoming <lometsj@live.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
> Signed-off-by: Steve French <stfrench@microsoft.com>
>
> diff --git a/fs/smb/server/smb2misc.c b/fs/smb/server/smb2misc.c
> index 23bd3d1209df..03dded29a980 100644
> --- a/fs/smb/server/smb2misc.c
> +++ b/fs/smb/server/smb2misc.c
> @@ -106,16 +106,25 @@ static int smb2_get_data_area_len(unsigned int *off,
> unsigned int *len,
>  		break;
>  	case SMB2_CREATE:
>  	{
> +		unsigned short int name_off =
> +			le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
> +		unsigned short int name_len =
> +			le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
> +
>  		if (((struct smb2_create_req *)hdr)->CreateContextsLength) {
>  			*off = le32_to_cpu(((struct smb2_create_req *)
>  				hdr)->CreateContextsOffset);
>  			*len = le32_to_cpu(((struct smb2_create_req *)
>  				hdr)->CreateContextsLength);
> -			break;
> +			if (!name_len)
> +				break;
> +
> +			if (name_off + name_len < (u64)*off + *len)
> +				break;
>  		}
>
> -		*off = le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
> -		*len = le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
> +		*off = name_off;
> +		*len = name_len;
>  		break;
>  	}
>  	case SMB2_QUERY_INFO:
>
>