Namjae Jeon
921536046b
ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
[ Upstream commit dc8289f912 ]
When smb1 mount fails, KASAN detect slab-out-of-bounds in
init_smb2_rsp_hdr like the following one.
For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called.
The issue occurs while handling smb1 negotiate as smb2 server operations.
Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr,
allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that
smb2 server operation does not handle it.
[ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is
not recommended unless required for access to very old servers
[ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes
[ 411.479312] ksmbd: init_smb2_rsp_hdr : 492
[ 411.479323] ==================================================================
[ 411.479327] BUG: KASAN: slab-out-of-bounds in
init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199
[ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G
OE 6.1.21 #3
[ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8
Series/Z10PA-D8 Series, BIOS 3801 08/23/2019
[ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
[ 411.479425] Call Trace:
[ 411.479428] <TASK>
[ 411.479432] dump_stack_lvl+0x49/0x63
[ 411.479444] print_report+0x171/0x4a8
[ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200
[ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[ 411.479497] kasan_report+0xb4/0x130
[ 411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[ 411.479537] kasan_check_range+0x149/0x1e0
[ 411.479543] memcpy+0x24/0x70
[ 411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[ 411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd]
[ 411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50
[ 411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd]
[ 411.479656] process_one_work+0x49c/0x790
[ 411.479667] worker_thread+0x2b1/0x6e0
[ 411.479674] ? process_one_work+0x790/0x790
[ 411.479680] kthread+0x177/0x1b0
[ 411.479686] ? kthread_complete_and_exit+0x30/0x30
[ 411.479692] ret_from_fork+0x22/0x30
[ 411.479702] </TASK>
Fixes: 39b291b86b ("ksmbd: return unsupported error on smb1 mount")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-23 10:41:54 +01:00
..
2023-11-28 16:56:19 +00:00
2023-02-01 08:27:06 +01:00
2023-12-20 15:17:34 +01:00
2023-09-23 11:09:54 +02:00
2023-12-20 15:17:41 +01:00
2022-07-02 16:41:14 +02:00
2023-10-19 23:05:36 +02:00
2023-12-13 18:36:50 +01:00
2023-03-10 09:39:50 +01:00
2022-12-31 13:14:15 +01:00
2022-11-10 18:15:37 +01:00
2022-12-31 13:14:03 +01:00
2022-02-01 17:27:01 +01:00
2023-09-19 12:22:52 +02:00
2022-07-02 16:41:14 +02:00
2023-09-06 21:28:37 +01:00
2023-11-28 16:56:19 +00:00
2022-06-09 10:23:32 +02:00
2023-09-23 11:09:57 +02:00
2023-12-20 15:17:41 +01:00
2023-11-28 16:56:34 +00:00
2022-06-09 10:22:42 +02:00
2021-10-04 22:13:12 +01:00
2023-12-20 15:17:38 +01:00
2023-11-28 16:56:22 +00:00
2023-03-10 09:39:57 +01:00
2023-05-24 17:36:43 +01:00
2021-08-26 22:28:02 +02:00
2022-12-31 13:14:44 +01:00
2023-12-08 08:48:05 +01:00
2021-11-12 15:05:50 +01:00
2023-11-28 16:56:30 +00:00
2023-07-23 13:47:34 +02:00
2023-11-28 16:56:18 +00:00
2023-07-23 13:47:23 +02:00
2023-12-23 10:41:54 +01:00
2023-09-19 12:22:43 +02:00
2022-04-13 20:59:10 +02:00
2021-12-29 12:28:59 +01:00
2023-11-28 16:56:21 +00:00
2021-10-04 22:02:17 +01:00
2023-11-28 16:56:34 +00:00
2023-12-13 18:36:43 +01:00
2023-09-19 12:22:27 +02:00
2023-07-23 13:47:36 +02:00
2022-11-26 09:24:52 +01:00
2023-11-08 17:26:46 +01:00
2023-09-19 12:22:34 +02:00
2022-12-31 13:14:44 +01:00
2023-11-28 16:56:29 +00:00
2023-12-03 07:31:24 +01:00
2023-11-20 11:08:13 +01:00
2021-09-21 08:36:48 -07:00
2023-11-28 16:56:31 +00:00
2023-07-23 13:47:33 +02:00
2023-09-19 12:22:30 +02:00
2021-12-14 10:57:12 +01:00
2023-02-22 12:57:07 +01:00
2023-08-11 15:13:58 +02:00
2023-09-23 11:10:02 +02:00
2023-05-17 11:50:14 +02:00
2023-09-19 12:22:53 +02:00
2021-09-27 11:26:21 -07:00
2023-09-19 12:22:52 +02:00
2023-11-28 16:56:26 +00:00
2023-04-05 11:25:01 +02:00
2023-02-22 12:57:05 +01:00
2023-09-23 11:10:01 +02:00
2021-09-05 10:15:05 -07:00
2023-10-06 13:18:24 +02:00
2022-11-03 23:59:12 +09:00
2022-06-09 10:22:26 +02:00
2022-12-31 13:14:39 +01:00
2022-11-26 09:24:51 +01:00
2022-12-31 13:14:30 +01:00
2022-04-08 14:24:18 +02:00
2021-09-02 10:07:29 -07:00
2022-09-28 11:11:56 +02:00
2021-09-03 09:58:10 -07:00
2023-09-19 12:22:30 +02:00
2023-06-21 15:59:14 +02:00
2022-11-03 23:59:12 +09:00
2021-09-03 10:08:28 -07:00
2022-10-26 12:34:58 +02:00
2023-08-11 15:13:58 +02:00
2023-07-23 13:47:34 +02:00
2021-09-07 16:07:47 -04:00
2023-11-20 11:08:13 +01:00
2023-12-08 08:48:04 +01:00
2023-08-30 16:18:19 +02:00
2022-05-25 09:57:26 +02:00
2021-09-12 10:10:21 -07:00
2021-10-18 20:22:03 -10:00
2022-12-31 13:14:03 +01:00
2023-09-23 11:09:55 +02:00
2022-12-14 11:37:31 +01:00
2023-01-12 11:59:20 +01:00
2023-09-19 12:22:30 +02:00
2023-04-13 16:48:25 +02:00
2023-08-11 15:13:57 +02:00
2022-06-06 08:43:37 +02:00
2023-01-12 11:58:47 +01:00
2022-07-02 16:41:17 +02:00
2022-07-02 16:41:14 +02:00
2022-12-19 12:36:39 +01:00
2022-07-21 21:24:14 +02:00
2022-01-29 10:58:25 +01:00
2022-07-12 16:35:08 +02:00
2021-12-14 10:57:15 +01:00
2022-10-26 12:34:17 +02:00
2022-04-27 14:38:57 +02:00
2023-05-24 17:36:54 +01:00
2023-08-11 15:13:58 +02:00
2022-04-27 14:38:50 +02:00
2022-10-26 12:34:36 +02:00
2022-12-31 13:14:01 +01:00