diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2023-05-30 23:10:31 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-06-02 12:30:57 -0500 |
| commit | 368ba06881c395f1c9a7ba22203cf8d78b4addc0 (patch) | |
| tree | d345ce739bf0a5db36471ed9eee5f3a43aaadfd3 /fs/stat.c | |
| parent | 25933573ef48f3586f559c2cac6c436c62dcf63f (diff) | |
ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop
The length field of netbios header must be greater than the SMB header
sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet.
If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`.
In the function `get_smb2_cmd_val` ksmbd will read cmd from
`rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN
detector to print the following error message:
[ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60
[ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task ksmbd:42632/248
...
[ 7.207125] <TASK>
[ 7.209191] get_smb2_cmd_val+0x45/0x60
[ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100
[ 7.209712] ksmbd_server_process_request+0x72/0x160
[ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550
[ 7.212280] kthread+0x160/0x190
[ 7.212762] ret_from_fork+0x1f/0x30
[ 7.212981] </TASK>
Cc: stable@vger.kernel.org
Reported-by: Chih-Yen Chang <cc85nod@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/stat.c')
0 files changed, 0 insertions, 0 deletions