On Mon, Dec 18, 2023 at 08:28:17PM +0900, Namjae Jeon wrote:
2023-12-18 19:38 GMT+09:00, Greg KH gregkh@linuxfoundation.org:
On Tue, Dec 12, 2023 at 01:47:45PM -0500, paul.gortmaker@windriver.com wrote:
From: Namjae Jeon linkinjeon@kernel.org
commit 368ba06881c395f1c9a7ba22203cf8d78b4addc0 upstream.
The length field of netbios header must be greater than the SMB header sizes(smb1 or smb2 header), otherwise the packet is an invalid SMB packet.
If `pdu_size` is 0, ksmbd allocates a 4 bytes chunk to `conn->request_buf`. In the function `get_smb2_cmd_val` ksmbd will read cmd from `rcv_hdr->Command`, which is `conn->request_buf + 12`, causing the KASAN detector to print the following error message:
[ 7.205018] BUG: KASAN: slab-out-of-bounds in get_smb2_cmd_val+0x45/0x60 [ 7.205423] Read of size 2 at addr ffff8880062d8b50 by task ksmbd:42632/248 ... [ 7.207125] <TASK> [ 7.209191] get_smb2_cmd_val+0x45/0x60 [ 7.209426] ksmbd_conn_enqueue_request+0x3a/0x100 [ 7.209712] ksmbd_server_process_request+0x72/0x160 [ 7.210295] ksmbd_conn_handler_loop+0x30c/0x550 [ 7.212280] kthread+0x160/0x190 [ 7.212762] ret_from_fork+0x1f/0x30 [ 7.212981] </TASK>
Cc: stable@vger.kernel.org Reported-by: Chih-Yen Chang cc85nod@gmail.com Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Steve French stfrench@microsoft.com [PG: fs/smb/server/connection.c --> fs/ksmbd/connection.c for v5.15. Also no smb2_get_msg() as no +4 from cb4517201b8a in v5.15 baseline.] Signed-off-by: Paul Gortmaker paul.gortmaker@windriver.com
fs/ksmbd/connection.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
Now queued up, thanks.
Could you please remove this patch in your queue ? This patches in my ksmbd backport queue and Since I have backported all patches(between 5.16 ~ 6.7-rc1), I included original patch that do not need to be changed unlike this patch.
https://github.com/namjaejeon/stable-linux-5.15-ksmbd
I am testing them before sending it. I plan to send all patches within this week.
Sure, will drop it now, thanks.
greg k-h