From: Greg KH <greg@kroah.com>
To: Sasha Levin <sashal@kernel.org>
Cc: stable@vger.kernel.org, Namjae Jeon <linkinjeon@kernel.org>,
Kanishka De Silva <kpskanna1915@gmail.com>,
Farhad Alemi <farhad.alemi@berkeley.edu>
Subject: Re: [PATCH 6.12.y 2/2] ksmbd: prevent out-of-bounds reads in share config responses
Date: Wed, 30 Sep 2026 15:20:59 +0200 [thread overview]
Message-ID: <2026093055-rink-mace-ba4c@gregkh> (raw)
In-Reply-To: <20260914141551.61407-2-sashal@kernel.org>
On Mon, Sep 14, 2026 at 10:15:51AM -0400, Sasha Levin wrote:
> From: Namjae Jeon <linkinjeon@kernel.org>
>
> [ Upstream commit f25e93768fcc5d8287e50b1ec52a42e4c276df34 ]
>
> Validate IPC share configuration payload sizes before consuming
> variable-length fields. Bound veto list parsing and account for
> the separator byte when deriving the path length.
>
> Fixes: a677ebd8ca2f ("ksmbd: validate payload size in ipc response")
> Reported-by: Kanishka De Silva <kpskanna1915@gmail.com>
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> fs/smb/server/mgmt/share_config.c | 40 +++++++++++++++++++++----------
> fs/smb/server/transport_ipc.c | 21 ++++++++++------
> 2 files changed, 41 insertions(+), 20 deletions(-)
>
> diff --git a/fs/smb/server/mgmt/share_config.c b/fs/smb/server/mgmt/share_config.c
> index 97b0bbd619979..e34e86cce0fc3 100644
> --- a/fs/smb/server/mgmt/share_config.c
> +++ b/fs/smb/server/mgmt/share_config.c
> @@ -88,9 +88,9 @@ static struct ksmbd_share_config *__share_lookup(const char *name)
>
> static int parse_veto_list(struct ksmbd_share_config *share,
> char *veto_list,
> - int veto_list_sz)
> + size_t veto_list_sz)
> {
> - int sz = 0;
> + size_t sz;
>
> if (!veto_list_sz)
> return 0;
> @@ -98,7 +98,7 @@ static int parse_veto_list(struct ksmbd_share_config *share,
> while (veto_list_sz > 0) {
> struct ksmbd_veto_pattern *p;
>
> - sz = strlen(veto_list);
> + sz = strnlen(veto_list, veto_list_sz);
> if (!sz)
> break;
>
> @@ -106,7 +106,7 @@ static int parse_veto_list(struct ksmbd_share_config *share,
> if (!p)
> return -ENOMEM;
>
> - p->pattern = kstrdup(veto_list, KSMBD_DEFAULT_GFP);
> + p->pattern = kstrndup(veto_list, sz, KSMBD_DEFAULT_GFP);
> if (!p->pattern) {
> kfree(p);
> return -ENOMEM;
> @@ -114,6 +114,9 @@ static int parse_veto_list(struct ksmbd_share_config *share,
>
> list_add(&p->list, &share->veto_list);
>
> + if (sz == veto_list_sz)
> + break;
> +
> veto_list += sz + 1;
> veto_list_sz -= (sz + 1);
> }
> @@ -165,17 +168,28 @@ static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work,
> }
>
> if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
> - int path_len = PATH_MAX;
> -
> - if (resp->payload_sz)
> - path_len = resp->payload_sz - resp->veto_list_sz;
> + size_t path_len;
>
> - share->path = kstrndup(ksmbd_share_config_path(resp), path_len,
> - KSMBD_DEFAULT_GFP);
> - if (!share->path) {
> - ret = -ENOMEM;
> + if (resp->payload_sz <= resp->veto_list_sz) {
> + ret = -EINVAL;
> } else {
> - ret = 0;
> + path_len = resp->payload_sz - resp->veto_list_sz;
> + if (resp->veto_list_sz)
> + path_len--;
> +
> + if (!path_len) {
> + ret = -EINVAL;
> + } else {
> + share->path = kstrndup(
> + ksmbd_share_config_path(resp),
> + path_len, KSMBD_DEFAULT_GFP);
> + if (!share->path)
> + ret = -ENOMEM;
> + else
> + ret = 0;
> + }
> + }
> + if (share->path) {
> share->path_sz = strlen(share->path);
> while (share->path_sz > 1 &&
> share->path[share->path_sz - 1] == '/')
> diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
> index a0b9b3def3346..10847d1cda4ac 100644
> --- a/fs/smb/server/transport_ipc.c
> +++ b/fs/smb/server/transport_ipc.c
> @@ -524,14 +524,21 @@ static int ipc_validate_msg(struct ipc_msg_table_entry *entry)
> if (entry->msg_sz < sizeof(struct ksmbd_share_config_response))
> return -EINVAL;
>
> - if (resp->payload_sz) {
> - if (resp->payload_sz < resp->veto_list_sz)
> - return -EINVAL;
> + if (strnlen(resp->share_name, sizeof(resp->share_name)) ==
> + sizeof(resp->share_name))
> + return -EINVAL;
>
> - if (check_add_overflow(sizeof(struct ksmbd_share_config_response),
> - resp->payload_sz, &msg_sz))
> - return -EINVAL;
> - }
> + if (resp->veto_list_sz > resp->payload_sz)
> + return -EINVAL;
> +
> + if (resp->flags != KSMBD_SHARE_FLAG_INVALID &&
> + !(resp->flags & KSMBD_SHARE_FLAG_PIPE) &&
> + resp->payload_sz <= resp->veto_list_sz)
> + return -EINVAL;
> +
> + if (check_add_overflow(sizeof(struct ksmbd_share_config_response),
> + resp->payload_sz, &msg_sz))
> + return -EINVAL;
> break;
> }
> case KSMBD_EVENT_LOGIN_REQUEST_EXT:
> --
> 2.53.0
>
>
Series did not apply
prev parent reply other threads:[~2026-09-30 13:21 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-14 11:03 FAILED: patch "[PATCH] ksmbd: prevent out-of-bounds reads in share config responses" failed to apply to 6.12-stable tree gregkh
2026-09-14 14:15 ` [PATCH 6.12.y 1/2] ksmbd: fail share config requests when path allocation fails Sasha Levin
2026-09-14 14:15 ` [PATCH 6.12.y 2/2] ksmbd: prevent out-of-bounds reads in share config responses Sasha Levin
2026-09-30 13:20 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026093055-rink-mace-ba4c@gregkh \
--to=greg@kroah.com \
--cc=farhad.alemi@berkeley.edu \
--cc=kpskanna1915@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox