ksmbd: validate minimum PDU size for transform requests

The receive path applies the minimum SMB2 PDU size check only when
ProtocolId is SMB2_PROTO_NUMBER. A packet carrying
SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated
dialect does not provide transform handling.

On an SMB 2.1 connection, a short transform packet therefore reaches
init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header
and reads beyond the request allocation. The copied fields can then be
returned to the unauthenticated client.

Compression transforms are converted to ordinary SMB2 messages before
protocol validation. After that conversion, validate ordinary SMB2
requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption
transform requests to contain both a transform header and an SMB2
header. This rejects truncated requests before work allocation.

Fixes: 368ba06881c3 ("ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-31063
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index 9e8fdb39e5a2a4f3eee1912deb09b0b3e9e8b574..dee8e4aced9946534a4d78a5c7a7967d6b303db3 100644 (file)
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -441,6 +441,8 @@ bool ksmbd_conn_alive(struct ksmbd_conn *conn)
 /* "+2" for BCC field (ByteCount, 2 bytes) */
 #define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2)
 #define SMB2_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb2_pdu))
+#define SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE  \
+       (sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr))
 
 /**
  * ksmbd_conn_handler_loop() - session thread to listen on new smb requests
@@ -455,6 +457,7 @@ int ksmbd_conn_handler_loop(void *p)
        struct ksmbd_conn *conn = (struct ksmbd_conn *)p;
        struct ksmbd_transport *t = conn->transport;
        unsigned int pdu_size, max_allowed_pdu_size, max_req;
+       __le32 proto;
        char hdr_buf[4] = {0,};
        int size;
 
@@ -546,11 +549,14 @@ recheck:
                if (!ksmbd_smb_request(conn))
                        break;
 
-               if (((struct smb2_hdr *)smb_get_msg(conn->request_buf))->ProtocolId ==
-                   SMB2_PROTO_NUMBER) {
-                       if (pdu_size < SMB2_MIN_SUPPORTED_PDU_SIZE)
-                               break;
-               }
+               proto = *(__le32 *)smb_get_msg(conn->request_buf);
+               if (proto == SMB2_PROTO_NUMBER &&
+                   pdu_size < SMB2_MIN_SUPPORTED_PDU_SIZE)
+                       break;
+
+               if (proto == SMB2_TRANSFORM_PROTO_NUM &&
+                   pdu_size < SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE)
+                       break;
 
                if (!default_conn_ops.process_fn) {
                        pr_err("No connection request callback\n");