From 99580c7183658a82c16619a7764eb919b047ada9 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 18 Dec 2023 11:38:13 +0100 Subject: [PATCH] 5.15-stable patches added patches: ksmbd-check-the-validation-of-pdu_size-in-ksmbd_conn_handler_loop.patch --- ...-pdu_size-in-ksmbd_conn_handler_loop.patch | 76 +++++++++++++++++++ queue-5.15/series | 1 + 2 files changed, 77 insertions(+) create mode 100644 queue-5.15/ksmbd-check-the-validation-of-pdu_size-in-ksmbd_conn_handler_loop.patch diff --git a/queue-5.15/ksmbd-check-the-validation-of-pdu_size-in-ksmbd_conn_handler_loop.patch b/queue-5.15/ksmbd-check-the-validation-of-pdu_size-in-ksmbd_conn_handler_loop.patch new file mode 100644 index 00000000000..fe2ea46c8c1 --- /dev/null +++ b/queue-5.15/ksmbd-check-the-validation-of-pdu_size-in-ksmbd_conn_handler_loop.patch @@ -0,0 +1,76 @@ +From 368ba06881c395f1c9a7ba22203cf8d78b4addc0 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Tue, 30 May 2023 23:10:31 +0900 +Subject: ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop + +From: Namjae Jeon + +commit 368ba06881c395f1c9a7ba22203cf8d78b4addc0 upstream. + +The length field of netbios header must be greater than the SMB header +sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet. + +If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`. +In the function `get_smb2_cmd_val` ksmbd will read cmd from +`rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN +detector to print the following error message: + +[ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60 +[ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task ksmbd:42632/248 +... +[ 7.207125] +[ 7.209191] get_smb2_cmd_val+0x45/0x60 +[ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100 +[ 7.209712] ksmbd_server_process_request+0x72/0x160 +[ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550 +[ 7.212280] kthread+0x160/0x190 +[ 7.212762] ret_from_fork+0x1f/0x30 +[ 7.212981] + +Cc: stable@vger.kernel.org +Reported-by: Chih-Yen Chang +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +[PG: fs/smb/server/connection.c --> fs/ksmbd/connection.c for v5.15. + Also no smb2_get_msg() as no +4 from cb4517201b8a in v5.15 baseline.] +Signed-off-by: Paul Gortmaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/connection.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/fs/ksmbd/connection.c ++++ b/fs/ksmbd/connection.c +@@ -263,6 +263,9 @@ bool ksmbd_conn_alive(struct ksmbd_conn + return true; + } + ++#define SMB1_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb_hdr)) ++#define SMB2_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb2_hdr)) ++ + /** + * ksmbd_conn_handler_loop() - session thread to listen on new smb requests + * @p: connection instance +@@ -319,6 +322,9 @@ int ksmbd_conn_handler_loop(void *p) + if (pdu_size > MAX_STREAM_PROT_LEN) + break; + ++ if (pdu_size < SMB1_MIN_SUPPORTED_HEADER_SIZE) ++ break; ++ + /* 4 for rfc1002 length field */ + /* 1 for implied bcc[0] */ + size = pdu_size + 4 + 1; +@@ -346,6 +352,12 @@ int ksmbd_conn_handler_loop(void *p) + continue; + } + ++ if (((struct smb2_hdr *)(conn->request_buf))->ProtocolId == ++ SMB2_PROTO_NUMBER) { ++ if (pdu_size < SMB2_MIN_SUPPORTED_HEADER_SIZE) ++ break; ++ } ++ + if (!default_conn_ops.process_fn) { + pr_err("No connection request callback\n"); + break; diff --git a/queue-5.15/series b/queue-5.15/series index 3fe26e38d0d..5eb2893e831 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -82,3 +82,4 @@ ring-buffer-have-saved-event-hold-the-entire-event.patch ring-buffer-fix-writing-to-the-buffer-with-max_data_size.patch ring-buffer-fix-a-race-in-rb_time_cmpxchg-for-32-bit-archs.patch ring-buffer-do-not-try-to-put-back-write_stamp.patch +ksmbd-check-the-validation-of-pdu_size-in-ksmbd_conn_handler_loop.patch -- 2.47.3