Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-23 20:51:44 +00:00
Code Issues Packages Projects Releases Wiki Activity
8f0541186e
linux/fs/ksmbd
History
Namjae Jeon 8f0541186e ksmbd: fix heap-based overflow in set_ntacl_dacl() 
The testcase use SMB2_SET_INFO_HE command to set a malformed file attribute
under the label `security.NTACL`. SMB2_QUERY_INFO_HE command in testcase
trigger the following overflow.

[ 4712.003781] ==================================================================
[ 4712.003790] BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x842/0x1dd0 [ksmbd]
[ 4712.003807] Write of size 1060 at addr ffff88801e34c068 by task kworker/0:0/4190

[ 4712.003813] CPU: 0 PID: 4190 Comm: kworker/0:0 Not tainted 5.19.0-rc5 #1
[ 4712.003850] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
[ 4712.003867] Call Trace:
[ 4712.003870]  <TASK>
[ 4712.003873]  dump_stack_lvl+0x49/0x5f
[ 4712.003935]  print_report.cold+0x5e/0x5cf
[ 4712.003972]  ? ksmbd_vfs_get_sd_xattr+0x16d/0x500 [ksmbd]
[ 4712.003984]  ? cmp_map_id+0x200/0x200
[ 4712.003988]  ? build_sec_desc+0x842/0x1dd0 [ksmbd]
[ 4712.004000]  kasan_report+0xaa/0x120
[ 4712.004045]  ? build_sec_desc+0x842/0x1dd0 [ksmbd]
[ 4712.004056]  kasan_check_range+0x100/0x1e0
[ 4712.004060]  memcpy+0x3c/0x60
[ 4712.004064]  build_sec_desc+0x842/0x1dd0 [ksmbd]
[ 4712.004076]  ? parse_sec_desc+0x580/0x580 [ksmbd]
[ 4712.004088]  ? ksmbd_acls_fattr+0x281/0x410 [ksmbd]
[ 4712.004099]  smb2_query_info+0xa8f/0x6110 [ksmbd]
[ 4712.004111]  ? psi_group_change+0x856/0xd70
[ 4712.004148]  ? update_load_avg+0x1c3/0x1af0
[ 4712.004152]  ? asym_cpu_capacity_scan+0x5d0/0x5d0
[ 4712.004157]  ? xas_load+0x23/0x300
[ 4712.004162]  ? smb2_query_dir+0x1530/0x1530 [ksmbd]
[ 4712.004173]  ? _raw_spin_lock_bh+0xe0/0xe0
[ 4712.004179]  handle_ksmbd_work+0x30e/0x1020 [ksmbd]
[ 4712.004192]  process_one_work+0x778/0x11c0
[ 4712.004227]  ? _raw_spin_lock_irq+0x8e/0xe0
[ 4712.004231]  worker_thread+0x544/0x1180
[ 4712.004234]  ? __cpuidle_text_end+0x4/0x4
[ 4712.004239]  kthread+0x282/0x320
[ 4712.004243]  ? process_one_work+0x11c0/0x11c0
[ 4712.004246]  ? kthread_complete_and_exit+0x30/0x30
[ 4712.004282]  ret_from_fork+0x1f/0x30

This patch add the buffer validation for security descriptor that is
stored by malformed SMB2_SET_INFO_HE command. and allocate large
response buffer about SMB2_O_INFO_SECURITY file info class.

Fixes: e2f34481b2 ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17771
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-08-04 09:51:38 -05:00
..
mgmt ksmbd: fix racy issue while destroying session on multichannel 2022-07-31 23:14:32 -05:00
asn1.c ksmbd: use oid registry functions to decode OIDs 2021-12-28 22:47:22 -06:00
asn1.h
auth.c ksmbd: fix racy issue while destroying session on multichannel 2022-07-31 23:14:32 -05:00
auth.h ksmbd: fix racy issue while destroying session on multichannel 2022-07-31 23:14:32 -05:00
connection.c ksmbd: use wait_event instead of schedule_timeout() 2022-07-31 23:14:32 -05:00
connection.h ksmbd: fix racy issue while destroying session on multichannel 2022-07-31 23:14:32 -05:00
crypto_ctx.c ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
crypto_ctx.h ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
glob.h ksmbd: fix version mismatch with out of tree 2021-10-07 10:18:34 -05:00
Kconfig ksmbd: remove md4 leftovers 2021-11-11 19:22:58 -06:00
ksmbd_netlink.h ksmbd: add smbd max io size parameter 2022-05-21 15:01:43 -05:00
ksmbd_spnego_negtokeninit.asn1
ksmbd_spnego_negtokentarg.asn1
ksmbd_work.c ksmbd: Remove redundant 'flush_workqueue()' calls 2021-11-06 23:52:06 -05:00
ksmbd_work.h ksmbd: remove smb2_buf_length in smb2_hdr 2021-11-11 19:22:58 -06:00
Makefile
misc.c ksmbd: Fix some kernel-doc comments 2022-05-21 15:01:43 -05:00
misc.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
ndr.c ksmbd: fix error code in ndr_read_int32() 2021-12-16 12:36:49 -06:00
ndr.h ksmbd: add user namespace support 2021-07-02 16:27:10 +09:00
nterr.h
ntlmssp.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00
oplock.c ksmbd: fix racy issue while destroying session on multichannel 2022-07-31 23:14:32 -05:00
oplock.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
server.c ksmbd: use wait_event instead of schedule_timeout() 2022-07-31 23:14:32 -05:00
server.h ksmbd: change server config string index to enumeration 2021-06-30 14:44:01 +09:00
smb2misc.c ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT 2022-07-31 23:14:32 -05:00
smb2ops.c ksmbd: add support for smb2 max credit parameter 2022-01-10 12:44:19 -06:00
smb2pdu.c ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-04 09:51:38 -05:00
smb2pdu.h 14 fixes to cifs client and to smbfs_common code 2022-04-01 14:31:57 -07:00
smb_common.c ksmbd: fix outstanding credits related bugs 2022-05-21 15:01:43 -05:00
smb_common.h ksmbd: fix racy issue while destroying session on multichannel 2022-07-31 23:14:32 -05:00
smbacl.c ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-04 09:51:38 -05:00
smbacl.h ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-04 09:51:38 -05:00
smbfsctl.h
smbstatus.h
transport_ipc.c ksmbd: add smbd max io size parameter 2022-05-21 15:01:43 -05:00
transport_ipc.h ksmbd: throttle session setup failures to avoid dictionary attacks 2021-10-20 00:07:10 -05:00
transport_rdma.c ksmbd: smbd: Remove useless license text when SPDX-License-Identifier is already used 2022-06-11 11:18:26 -05:00
transport_rdma.h ksmbd: fix wrong smbd max read/write size check 2022-05-21 15:01:43 -05:00
transport_tcp.c ksmbd: use SOCK_NONBLOCK type for kernel_accept() 2022-06-11 11:18:26 -05:00
transport_tcp.h
unicode.c
unicode.h
uniupr.h
vfs_cache.c ksmbd: fix racy issue while destroying session on multichannel 2022-07-31 23:14:32 -05:00
vfs_cache.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
vfs.c ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-04 09:51:38 -05:00
vfs.h ksmbd: don't align last entry offset in smb2 query directory 2022-02-04 00:12:22 -06:00
xattr.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00