• Namjae Jeon's avatar
    ksmbd: validate command payload size · 2b9b8f3b
    Namjae Jeon authored
    ->StructureSize2 indicates command payload size. ksmbd should validate
    this size with rfc1002 length before accessing it.
    This patch remove unneeded check and add the validation for this.
    
    [    8.912583] BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message+0x12a/0xc50
    [    8.913051] Read of size 2 at addr ffff88800ac7d92c by task kworker/0:0/7
    ...
    [    8.914967] Call Trace:
    [    8.915126]  <TASK>
    [    8.915267]  dump_stack_lvl+0x33/0x50
    [    8.915506]  print_report+0xcc/0x620
    [    8.916558]  kasan_report+0xae/0xe0
    [    8.917080]  kasan_check_range+0x35/0x1b0
    [    8.917334]  ksmbd_smb2_check_message+0x12a/0xc50
    [    8.917935]  ksmbd_verify_smb_message+0xae/0xd0
    [    8.918223]  handle_ksmbd_work+0x192/0x820
    [    8.918478]  process_one_work+0x419/0x760
    [    8.918727]  worker_thread+0x2a2/0x6f0
    [    8.919222]  kthread+0x187/0x1d0
    [    8.919723]  ret_from_fork+0x1f/0x30
    [    8.919954]  </TASK>
    
    Cc: stable@vger.kernel.org
    Reported-by: default avatarChih-Yen Chang <cc85nod@gmail.com>
    Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
    2b9b8f3b
smb2misc.c 12.8 KB