smb/client: fix possible infinite loop and oob read in symlink_data()

On 32-bit architectures, the infinite loop is as follows:

  len = p->ErrorDataLength == 0xfffffff8
  u8 *next = p->ErrorContextData + len
  next == p

On 32-bit architectures, the out-of-bounds read is as follows:

  len = p->ErrorDataLength == 0xfffffff0
  u8 *next = p->ErrorContextData + len
  next == (u8 *)p - 8

Reported-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
Cc: stable@vger.kernel.org
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c
index b292aa94a5932a034a01c24e98e2c3c8d7e5d233..6860eff3169329de5c7877824a832f8bea729188 100644 (file)
--- a/fs/smb/client/smb2file.c
+++ b/fs/smb/client/smb2file.c
@@ -49,6 +49,9 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
                                 __func__, le32_to_cpu(p->ErrorId));
 
                        len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
+                       if (len > end - ((u8 *)p + sizeof(*p)))
+                               return ERR_PTR(-EINVAL);
+
                        p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
                }
        } else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&