From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EBC1647F78B for ; Mon, 14 Sep 2026 14:39:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396767; cv=none; b=bveIKpzXCO5w/9+JpyKlYTkJgparUZ1tiEAqNzVnDxI988+SklnTPfnZaM915QxlN9+Hk/xPFpehF4vFZR5SMm4R6xT/BMOfTPK7Ogbn5TKhrhFy2ut6N1xiHMbOgzW0epJEnNT1r4IVILDPkNX01izEo/QqhKaEs48hb9lC8nY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396767; c=relaxed/simple; bh=7Tmryyf/ZXBbgLe0FuBZqsS6osVn+v2B6+a4vV0B/TM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DqeSYPSRHSOtba5r3RwoPIT+vd5+SeeAdU8FOdfox1ph+r/4/1KYaGRMPRG0cjMWefR/EZmFHHDZNEuz7/dzmbqGoSr5jO7pBHywHx/KPIa9n4sqRRLt9DEbYWBUYmIgbwe2WNCLaECA8Nk/1HDjcraw3Won4vu4FMi8EyKDvow= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cqQcO+22; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cqQcO+22" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DD161F00898; Mon, 14 Sep 2026 14:39:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789396764; bh=G7O2j3wUPmbbpAFVbfzDg9BJ8joJN8s1+8X3xdPA9P4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cqQcO+2269PoymubP99C6nux+jz5wEkcpOEZlV3cIedvuihNA7HwRBZbhcvMq3NGd EjfaE7ebYjqBVvAQ5hs16sSPS5ht30umhhPtZnkihnUgIoMb+bgnSkC1kwlDuUnubA 6ZF5x9iGIgfzev8WLr8kRUAcNFspalVdWM5esWvItSNhvLMQAdN9yVFpfwQOjxs1gM +RQXGVTGkHcYqKUAYbFbWVid+H8aYw/2JVfxEwcqVDHvWRfXl7X8zZZU1XSUwpoGPs COM/rmcMxJTBCphUyIpGiJvwqs5FOfIoyvAVZxhdK2gpa0LSXzdK2zHfy/VInM+bLS GS5J5ba2T5qWg== From: Sasha Levin To: stable@vger.kernel.org Cc: Namjae Jeon , Kanishka De Silva , Farhad Alemi , Sasha Levin Subject: [PATCH 6.6.y 2/2] ksmbd: prevent out-of-bounds reads in share config responses Date: Mon, 14 Sep 2026 10:39:20 -0400 Message-ID: <20260914143920.70748-2-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260914143920.70748-1-sashal@kernel.org> References: <2026091411-kept-parish-8e82@gregkh> <20260914143920.70748-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Namjae Jeon [ Upstream commit f25e93768fcc5d8287e50b1ec52a42e4c276df34 ] Validate IPC share configuration payload sizes before consuming variable-length fields. Bound veto list parsing and account for the separator byte when deriving the path length. Fixes: a677ebd8ca2f ("ksmbd: validate payload size in ipc response") Reported-by: Kanishka De Silva Reported-by: Farhad Alemi Signed-off-by: Namjae Jeon Signed-off-by: Sasha Levin --- fs/smb/server/mgmt/share_config.c | 40 +++++++++++++++++++++---------- fs/smb/server/transport_ipc.c | 21 ++++++++++------ 2 files changed, 41 insertions(+), 20 deletions(-) diff --git a/fs/smb/server/mgmt/share_config.c b/fs/smb/server/mgmt/share_config.c index 97b0bbd619979..e34e86cce0fc3 100644 --- a/fs/smb/server/mgmt/share_config.c +++ b/fs/smb/server/mgmt/share_config.c @@ -88,9 +88,9 @@ static struct ksmbd_share_config *__share_lookup(const char *name) static int parse_veto_list(struct ksmbd_share_config *share, char *veto_list, - int veto_list_sz) + size_t veto_list_sz) { - int sz = 0; + size_t sz; if (!veto_list_sz) return 0; @@ -98,7 +98,7 @@ static int parse_veto_list(struct ksmbd_share_config *share, while (veto_list_sz > 0) { struct ksmbd_veto_pattern *p; - sz = strlen(veto_list); + sz = strnlen(veto_list, veto_list_sz); if (!sz) break; @@ -106,7 +106,7 @@ static int parse_veto_list(struct ksmbd_share_config *share, if (!p) return -ENOMEM; - p->pattern = kstrdup(veto_list, KSMBD_DEFAULT_GFP); + p->pattern = kstrndup(veto_list, sz, KSMBD_DEFAULT_GFP); if (!p->pattern) { kfree(p); return -ENOMEM; @@ -114,6 +114,9 @@ static int parse_veto_list(struct ksmbd_share_config *share, list_add(&p->list, &share->veto_list); + if (sz == veto_list_sz) + break; + veto_list += sz + 1; veto_list_sz -= (sz + 1); } @@ -165,17 +168,28 @@ static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work, } if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { - int path_len = PATH_MAX; - - if (resp->payload_sz) - path_len = resp->payload_sz - resp->veto_list_sz; + size_t path_len; - share->path = kstrndup(ksmbd_share_config_path(resp), path_len, - KSMBD_DEFAULT_GFP); - if (!share->path) { - ret = -ENOMEM; + if (resp->payload_sz <= resp->veto_list_sz) { + ret = -EINVAL; } else { - ret = 0; + path_len = resp->payload_sz - resp->veto_list_sz; + if (resp->veto_list_sz) + path_len--; + + if (!path_len) { + ret = -EINVAL; + } else { + share->path = kstrndup( + ksmbd_share_config_path(resp), + path_len, KSMBD_DEFAULT_GFP); + if (!share->path) + ret = -ENOMEM; + else + ret = 0; + } + } + if (share->path) { share->path_sz = strlen(share->path); while (share->path_sz > 1 && share->path[share->path_sz - 1] == '/') diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c index bbe039a05b1c3..80fd1316d176b 100644 --- a/fs/smb/server/transport_ipc.c +++ b/fs/smb/server/transport_ipc.c @@ -524,14 +524,21 @@ static int ipc_validate_msg(struct ipc_msg_table_entry *entry) if (entry->msg_sz < sizeof(struct ksmbd_share_config_response)) return -EINVAL; - if (resp->payload_sz) { - if (resp->payload_sz < resp->veto_list_sz) - return -EINVAL; + if (strnlen(resp->share_name, sizeof(resp->share_name)) == + sizeof(resp->share_name)) + return -EINVAL; - if (check_add_overflow(sizeof(struct ksmbd_share_config_response), - resp->payload_sz, &msg_sz)) - return -EINVAL; - } + if (resp->veto_list_sz > resp->payload_sz) + return -EINVAL; + + if (resp->flags != KSMBD_SHARE_FLAG_INVALID && + !(resp->flags & KSMBD_SHARE_FLAG_PIPE) && + resp->payload_sz <= resp->veto_list_sz) + return -EINVAL; + + if (check_add_overflow(sizeof(struct ksmbd_share_config_response), + resp->payload_sz, &msg_sz)) + return -EINVAL; break; } case KSMBD_EVENT_LOGIN_REQUEST_EXT: -- 2.53.0