• Kuan-Ting Chen's avatar
    ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate · d738950f
    Kuan-Ting Chen authored
    Check request_buf length first to avoid out-of-bounds read by
    req->DialectCount.
    
    [ 3350.990282] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x35d7/0x3e60
    [ 3350.990282] Read of size 2 at addr ffff88810ad61346 by task kworker/5:0/276
    [ 3351.000406] Workqueue: ksmbd-io handle_ksmbd_work
    [ 3351.003499] Call Trace:
    [ 3351.006473]  <TASK>
    [ 3351.006473]  dump_stack_lvl+0x8d/0xe0
    [ 3351.006473]  print_report+0xcc/0x620
    [ 3351.006473]  kasan_report+0x92/0xc0
    [ 3351.006473]  smb2_handle_negotiate+0x35d7/0x3e60
    [ 3351.014760]  ksmbd_smb_negotiate_common+0x7a7/0xf00
    [ 3351.014760]  handle_ksmbd_work+0x3f7/0x12d0
    [ 3351.014760]  process_one_work+0xa85/0x1780
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarKuan-Ting Chen <h3xrabbit@gmail.com>
    Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
    d738950f
smb2pdu.c 231 KB