Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

smb: client: fix OOB in receive_encrypted_standard()

Browse source 
[ Upstream commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 ]

Fix potential OOB in receive_encrypted_standard() if server returned a
large shdr->NextCommand that would end up writing off the end of
@next_buffer.

Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[Guru: receive_encrypted_standard() is present in file smb2ops.c,
smb2ops.c file location is changed, modified patch accordingly.]
Signed-off-by: Guruswamy Basavaiah <guruswamy.basavaiah@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Paulo Alcantara 2024-02-11 01:44:42 +05:30 • committed by Ksawlii
parent c3a9310fcb
commit d6b4beea04
1 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
fs/cifs/smb2ops.c
View file

@ -4892,6 +4892,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
struct smb2_sync_hdr *shdr; struct smb2_sync_hdr *shdr;
unsigned int pdu_length = server->pdu_size; unsigned int pdu_length = server->pdu_size;
unsigned int buf_size; unsigned int buf_size;
unsigned int next_cmd;
struct mid_q_entry *mid_entry; struct mid_q_entry *mid_entry;
int next_is_large; int next_is_large;
char *next_buffer = NULL; char *next_buffer = NULL;
@ -4920,14 +4921,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
next_is_large = server->large_buf; next_is_large = server->large_buf;
one_more: one_more:
shdr = (struct smb2_sync_hdr *)buf; shdr = (struct smb2_sync_hdr *)buf;
if (shdr->NextCommand) { next_cmd = le32_to_cpu(shdr->NextCommand);
if (next_cmd) {
if (WARN_ON_ONCE(next_cmd > pdu_length))
return -1;
if (next_is_large) if (next_is_large)
next_buffer = (char *)cifs_buf_get(); next_buffer = (char *)cifs_buf_get();
else else
next_buffer = (char *)cifs_small_buf_get(); next_buffer = (char *)cifs_small_buf_get();
memcpy(next_buffer, memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd);
buf + le32_to_cpu(shdr->NextCommand),
pdu_length - le32_to_cpu(shdr->NextCommand));
} }
mid_entry = smb2_find_mid(server, buf); mid_entry = smb2_find_mid(server, buf);
@ -4951,8 +4953,8 @@ one_more:
else else
ret = cifs_handle_standard(server, mid_entry); ret = cifs_handle_standard(server, mid_entry);
if (ret == 0 && shdr->NextCommand) { if (ret == 0 && next_cmd) {
pdu_length -= le32_to_cpu(shdr->NextCommand); pdu_length -= next_cmd;
server->large_buf = next_is_large; server->large_buf = next_is_large;
if (next_is_large) if (next_is_large)
server->bigbuf = buf = next_buffer; server->bigbuf = buf = next_buffer;