lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 869/917] ksmbd: Fix buffer length check in fsctl_validate_negotiate_info()
    Date
    From: Marios Makassikis <mmakassikis@freebox.fr>

    commit 78f1688a64cca77758ceb9b183088cf0054bfc82 upstream.

    The validate_negotiate_info_req struct definition includes an extra
    field to access the data coming after the header. This causes the check
    in fsctl_validate_negotiate_info() to count the first element of the
    array twice. This in turn makes some valid requests fail, depending on
    whether they include padding or not.

    Fixes: f7db8fd03a4b ("ksmbd: add validation in smb2_ioctl")
    Cc: stable@vger.kernel.org # v5.15
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Acked-by: Hyunchul Lee <hyc.lee@gmail.com>
    Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/ksmbd/smb2pdu.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/ksmbd/smb2pdu.c
    +++ b/fs/ksmbd/smb2pdu.c
    @@ -7319,7 +7319,7 @@ static int fsctl_validate_negotiate_info
    int ret = 0;
    int dialect;

    - if (in_buf_len < sizeof(struct validate_negotiate_info_req) +
    + if (in_buf_len < offsetof(struct validate_negotiate_info_req, Dialects) +
    le16_to_cpu(neg_req->DialectCount) * sizeof(__le16))
    return -EINVAL;


    \
     
     \ /
      Last update: 2021-11-16 01:44    [W:3.216 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site