diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2024-04-11 23:02:15 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-04-27 17:07:17 +0200 |
| commit | b80ba648714e6d790d69610cf14656be222d0248 (patch) | |
| tree | 0346a327e79ff911eadc641ddf2f227814627ea6 | |
| parent | 7d51db455ca03e5270cc585a75a674abd063fa6c (diff) | |
| download | linux-stable-b80ba648714e6d790d69610cf14656be222d0248.tar.gz linux-stable-b80ba648714e6d790d69610cf14656be222d0248.tar.bz2 linux-stable-b80ba648714e6d790d69610cf14656be222d0248.zip | |
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
commit c119f4ede3fa90a9463f50831761c28f989bfb20 upstream.
If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size
validation could be skipped. if request size is smaller than
sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in
smb2_allocate_rsp_buf(). This patch allocate response buffer after
decrypting transform request. smb3_decrypt_req() will validate transform
request size and avoid slab-out-of-bound in smb2_allocate_rsp_buf().
Reported-by: Norbert Szetei <norbert@doyensec.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/smb/server/server.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c index 11b201e6ee44..63b01f7d9703 100644 --- a/fs/smb/server/server.c +++ b/fs/smb/server/server.c @@ -167,20 +167,17 @@ static void __handle_ksmbd_work(struct ksmbd_work *work, int rc; bool is_chained = false; - if (conn->ops->allocate_rsp_buf(work)) - return; - if (conn->ops->is_transform_hdr && conn->ops->is_transform_hdr(work->request_buf)) { rc = conn->ops->decrypt_req(work); - if (rc < 0) { - conn->ops->set_rsp_status(work, STATUS_DATA_ERROR); - goto send; - } - + if (rc < 0) + return; work->encrypted = true; } + if (conn->ops->allocate_rsp_buf(work)) + return; + rc = conn->ops->init_rsp_hdr(work); if (rc) { /* either uid or tid is not correct */ |