NothingOSS/android_kernel_msm-6.1_nothing_sm7635
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

Browse source 
commit d10c77873ba1e9e6b91905018e29e196fd5f863d upstream.

If ->NameOffset/Length is bigger than ->CreateContextsOffset/Length,
ksmbd_check_message doesn't validate request buffer it correctly.
So slab-out-of-bounds warning from calling smb_strndup_from_utf16()
in smb2_open() could happen. If ->NameLength is non-zero, Set the larger
of the two sums (Name and CreateContext size) as the offset and length of
the data area.

Reported-by: Yang Chaoming <lometsj@live.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Namjae Jeon 2023-12-20 15:52:11 +09:00 • committed by Greg Kroah-Hartman
parent b9c5f0fd5c
commit 7a3bbbadac
1 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
fs/smb/server/smb2misc.c
View file

@ -106,16 +106,25 @@ static int smb2_get_data_area_len(unsigned int *off, unsigned int *len,
break; break;
case SMB2_CREATE: case SMB2_CREATE:
{ {
unsigned short int name_off =
le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
unsigned short int name_len =
le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
if (((struct smb2_create_req *)hdr)->CreateContextsLength) { if (((struct smb2_create_req *)hdr)->CreateContextsLength) {
*off = le32_to_cpu(((struct smb2_create_req *) *off = le32_to_cpu(((struct smb2_create_req *)
hdr)->CreateContextsOffset); hdr)->CreateContextsOffset);
*len = le32_to_cpu(((struct smb2_create_req *) *len = le32_to_cpu(((struct smb2_create_req *)
hdr)->CreateContextsLength); hdr)->CreateContextsLength);
break; if (!name_len)
break;
if (name_off + name_len < (u64)*off + *len)
break;
} }
*off = le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset); *off = name_off;
*len = le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength); *len = name_len;
break; break;
} }
case SMB2_QUERY_INFO: case SMB2_QUERY_INFO: