Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/fs
History
Paulo Alcantara 9e1e53993d smb: client: fix OOB in smb2_query_reparse_point() 
[ Upstream commit 3a42709fa909e22b0be4bb1e2795aa04ada732a3 ]

Validate @ioctl_rsp->OutputOffset and @ioctl_rsp->OutputCount so that
their sum does not wrap to a number that is smaller than @reparse_buf
and we end up with a wild pointer as follows:

  BUG: unable to handle page fault for address: ffff88809c5cd45f
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 4a01067 P4D 4a01067 PUD 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 2 PID: 1260 Comm: mount.cifs Not tainted 6.7.0-rc4 #2
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
  RIP: 0010:smb2_query_reparse_point+0x3e0/0x4c0 [cifs]
  Code: ff ff e8 f3 51 fe ff 41 89 c6 58 5a 45 85 f6 0f 85 14 fe ff ff
  49 8b 57 48 8b 42 60 44 8b 42 64 42 8d 0c 00 49 39 4f 50 72 40 <8b>
  04 02 48 8b 9d f0 fe ff ff 49 8b 57 50 89 03 48 8b 9d e8 fe ff
  RSP: 0018:ffffc90000347a90 EFLAGS: 00010212
  RAX: 000000008000001f RBX: ffff88800ae11000 RCX: 00000000000000ec
  RDX: ffff88801c5cd440 RSI: 0000000000000000 RDI: ffffffff82004aa4
  RBP: ffffc90000347bb0 R08: 00000000800000cd R09: 0000000000000001
  R10: 0000000000000000 R11: 0000000000000024 R12: ffff8880114d4100
  R13: ffff8880114d4198 R14: 0000000000000000 R15: ffff8880114d4000
  FS: 00007f02c07babc0(0000) GS:ffff88806ba00000(0000)
  knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffff88809c5cd45f CR3: 0000000011750000 CR4: 0000000000750ef0
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? __die+0x23/0x70
   ? page_fault_oops+0x181/0x480
   ? search_module_extables+0x19/0x60
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? exc_page_fault+0x1b6/0x1c0
   ? asm_exc_page_fault+0x26/0x30
   ? _raw_spin_unlock_irqrestore+0x44/0x60
   ? smb2_query_reparse_point+0x3e0/0x4c0 [cifs]
   cifs_get_fattr+0x16e/0xa50 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? lock_acquire+0xbf/0x2b0
   cifs_root_iget+0x163/0x5f0 [cifs]
   cifs_smb3_do_mount+0x5bd/0x780 [cifs]
   smb3_get_tree+0xd9/0x290 [cifs]
   vfs_get_tree+0x2c/0x100
   ? capable+0x37/0x70
   path_mount+0x2d7/0xb80
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? _raw_spin_unlock_irqrestore+0x44/0x60
   __x64_sys_mount+0x11a/0x150
   do_syscall_64+0x47/0xf0
   entry_SYSCALL_64_after_hwframe+0x6f/0x77
  RIP: 0033:0x7f02c08d5b1e

Fixes: 2e4564b31b64 ("smb3: add support for stat of WSL reparse points for special file types")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:11:58 +01:00
..
9p Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
adfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
affs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
afs afs: Fix refcount underflow from error handling race 2024-11-18 12:11:48 +01:00
autofs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
befs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
btrfs Revert "btrfs: add dmesg output for first mount and last unmount of a filesystem" 2024-11-18 12:11:47 +01:00
cachefiles Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ceph ceph: fix type promotion bug on 32bit systems 2024-11-08 11:25:50 +01:00
cifs smb: client: fix OOB in smb2_query_reparse_point() 2024-11-18 12:11:58 +01:00
coda Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
configfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crypto Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debugfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
devpts Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ecryptfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
efivarfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
efs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
erofs BACKPORT: erofs: fix lz4 inplace decompression 2024-11-17 17:41:30 +01:00
exfat exfat: support handle zero-size directory 2024-11-18 11:43:14 +01:00
exportfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ext2 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ext4 ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS 2024-11-18 12:11:57 +01:00
f2fs f2fs: avoid format-overflow warning 2024-11-18 11:43:31 +01:00
fat Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
freevxfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fscache Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fuse fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() 2024-11-18 12:11:50 +01:00
gfs2 gfs2: Silence "suspicious RCU usage in gfs2_permission" warning 2024-11-18 11:43:19 +01:00
hfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hfsplus Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hostfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hpfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hugetlbfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
incfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iomap Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
isofs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
jbd2 jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev 2024-11-18 11:43:25 +01:00
jffs2 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
jfs jfs: fix array-index-out-of-bounds in diAlloc 2024-11-18 11:43:14 +01:00
kernfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lockd Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
minix Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfs NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO 2024-11-18 11:43:19 +01:00
nfs_common Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfsd nfsd: lock_rename() needs both directories to live on the same fs 2024-11-18 12:10:57 +01:00
nilfs2 nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() 2024-11-18 12:11:41 +01:00
nls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
notify Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ntfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
omfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
openpromfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
orangefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
overlayfs ima: detect changes to the backing overlay file 2024-11-18 11:43:25 +01:00
proc watchdog: move softlockup_panic back to early_param 2024-11-18 11:43:21 +01:00
pstore pstore/platform: Add check for kstrdup 2024-11-18 11:42:47 +01:00
qnx4 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qnx6 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
quota quota: explicitly forbid quota files from being encrypted 2024-11-18 11:43:25 +01:00
ramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reiserfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
romfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sdfat Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
squashfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tracefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ubifs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ufs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
unicode Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vboxsf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
verity Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
zonefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
aio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
anon_inodes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
attr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bad_inode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_aout.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_elf_fdpic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_em86.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_flat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_misc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_script.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block_dev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
buffer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
char_dev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compat_binfmt_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
coredump.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
d_path.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dax.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dcache.c Revert "fs: set VFS cache pressure to 20" 2024-11-18 08:00:43 +01:00
dcookies.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
direct-io.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlog_hook.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drop_caches.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventpoll.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exec.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
fcntl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fhandle.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file_table.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
filesystems.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs-writeback.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_context.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_parser.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_pin.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_struct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_types.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fsopen.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
init.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode.c fs: add ctime accessors infrastructure 2024-11-18 12:11:13 +01:00
internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ioctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.binfmt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kernel_read_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
libfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
locks.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mbcache.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mount.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mpage.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
namei.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
no-block.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nsfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
open.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
pipe.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pnode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pnode.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
posix_acl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
proc_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
read_write.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
readdir.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
remap_range.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
select.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
seq_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
signalfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
splice.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stack.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
statfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
super.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sync.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
timerfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
userfaultfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utimes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xattr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00