Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6726429c authored by Paulo Alcantara's avatar Paulo Alcantara Committed by Greg Kroah-Hartman
Browse files

smb: client: fix potential OOBs in smb2_parse_contexts() 



commit af1689a9b7701d9907dfc84d2a4b57c4bc907144 upstream.

Validate offsets and lengths before dereferencing create contexts in
smb2_parse_contexts().

This fixes following oops when accessing invalid create contexts from
server:

  BUG: unable to handle page fault for address: ffff8881178d8cc3
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 4a01067 P4D 4a01067 PUD 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
  RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]
  Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00
  00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7
  7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00
  RSP: 0018:ffffc900007939e0 EFLAGS: 00010216
  RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90
  RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000
  RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000
  R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000
  R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22
  FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)
  knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? __die+0x23/0x70
   ? page_fault_oops+0x181/0x480
   ? search_module_extables+0x19/0x60
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? exc_page_fault+0x1b6/0x1c0
   ? asm_exc_page_fault+0x26/0x30
   ? smb2_parse_contexts+0xa0/0x3a0 [cifs]
   SMB2_open+0x38d/0x5f0 [cifs]
   ? smb2_is_path_accessible+0x138/0x260 [cifs]
   smb2_is_path_accessible+0x138/0x260 [cifs]
   cifs_is_path_remote+0x8d/0x230 [cifs]
   cifs_mount+0x7e/0x350 [cifs]
   cifs_smb3_do_mount+0x128/0x780 [cifs]
   smb3_get_tree+0xd9/0x290 [cifs]
   vfs_get_tree+0x2c/0x100
   ? capable+0x37/0x70
   path_mount+0x2d7/0xb80
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? _raw_spin_unlock_irqrestore+0x44/0x60
   __x64_sys_mount+0x11a/0x150
   do_syscall_64+0x47/0xf0
   entry_SYSCALL_64_after_hwframe+0x6f/0x77
  RIP: 0033:0x7f8737657b1e

Reported-by: default avatarRobert Morris <rtm@csail.mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
[Guru: Removed changes to cached_dir.c and checking return value
of smb2_parse_contexts in smb2ops.c]
Signed-off-by: default avatarGuruswamy Basavaiah <guruswamy.basavaiah@broadcom.com>
[v5.4: Fixed merge-conflicts in smb2_parse_contexts for
missing parameter POSIX response]
Signed-off-by: default avatarShaoying Xu <shaoyi@amazon.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent db389e74

fs/cifs/smb2ops.c

+3 −1
Original line number Diff line number Diff line
@@ -787,9 +787,11 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, 
	/* BB TBD check to see if oplock level check can be removed below */

	if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE) {

		kref_get(&tcon->crfid.refcount);

		smb2_parse_contexts(server, o_rsp,

		rc = smb2_parse_contexts(server, rsp_iov,

				&oparms.fid->epoch,

				oparms.fid->lease_key, &oplock, NULL);

		if (rc)

			goto oshr_exit;

	} else

		goto oshr_exit;

fs/cifs/smb2pdu.c

+53 −28
Original line number Diff line number Diff line
@@ -1929,48 +1929,73 @@ parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 
	buf->IndexNumber = pdisk_id->DiskFileId;

}



void

smb2_parse_contexts(struct TCP_Server_Info *server,

		       struct smb2_create_rsp *rsp,

		       unsigned int *epoch, char *lease_key, __u8 *oplock,

int smb2_parse_contexts(struct TCP_Server_Info *server,

			struct kvec *rsp_iov,

			unsigned int *epoch,

			char *lease_key, __u8 *oplock,

			struct smb2_file_all_info *buf)

{

	char *data_offset;

	struct smb2_create_rsp *rsp = rsp_iov->iov_base;

	struct create_context *cc;

	unsigned int next;

	unsigned int remaining;

	size_t rem, off, len;

	size_t doff, dlen;

	size_t noff, nlen;

	char *name;



	*oplock = 0;

	data_offset = (char *)rsp + le32_to_cpu(rsp->CreateContextsOffset);

	remaining = le32_to_cpu(rsp->CreateContextsLength);

	cc = (struct create_context *)data_offset;



	off = le32_to_cpu(rsp->CreateContextsOffset);

	rem = le32_to_cpu(rsp->CreateContextsLength);

	if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len)

		return -EINVAL;

	cc = (struct create_context *)((u8 *)rsp + off);



	/* Initialize inode number to 0 in case no valid data in qfid context */

	if (buf)

		buf->IndexNumber = 0;



	while (remaining >= sizeof(struct create_context)) {

		name = le16_to_cpu(cc->NameOffset) + (char *)cc;

		if (le16_to_cpu(cc->NameLength) == 4 &&

		    strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4) == 0)

	while (rem >= sizeof(*cc)) {

		doff = le16_to_cpu(cc->DataOffset);

		dlen = le32_to_cpu(cc->DataLength);

		if (check_add_overflow(doff, dlen, &len) || len > rem)

			return -EINVAL;



		noff = le16_to_cpu(cc->NameOffset);

		nlen = le16_to_cpu(cc->NameLength);

		if (noff + nlen >= doff)

			return -EINVAL;



		name = (char *)cc + noff;

		switch (nlen) {

		case 4:

			if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) {

				*oplock = server->ops->parse_lease_buf(cc, epoch,

								       lease_key);

		else if (buf && (le16_to_cpu(cc->NameLength) == 4) &&

		    strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4) == 0)

			} else if (buf &&

				   !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) {

				parse_query_id_ctxt(cc, buf);

			}

			break;

		default:

			cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n",

				 __func__, nlen, dlen);

			if (IS_ENABLED(CONFIG_CIFS_DEBUG2))

				cifs_dump_mem("context data: ", cc, dlen);

			break;

		}



		next = le32_to_cpu(cc->Next);

		if (!next)

		off = le32_to_cpu(cc->Next);

		if (!off)

			break;

		remaining -= next;

		cc = (struct create_context *)((char *)cc + next);

		if (check_sub_overflow(rem, off, &rem))

			return -EINVAL;

		cc = (struct create_context *)((u8 *)cc + off);

	}



	if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE)

		*oplock = rsp->OplockLevel;



	return;

	return 0;

}



static int
@@ -2680,7 +2705,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 
	}





	smb2_parse_contexts(server, rsp, &oparms->fid->epoch,

	rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch,

				 oparms->fid->lease_key, oplock, buf);

creat_exit:

	SMB2_open_free(&rqst);

fs/cifs/smb2proto.h

+6 −4
Original line number Diff line number Diff line
@@ -238,10 +238,12 @@ extern int smb3_validate_negotiate(const unsigned int, struct cifs_tcon *); 


extern enum securityEnum smb2_select_sectype(struct TCP_Server_Info *,

					enum securityEnum);

extern void smb2_parse_contexts(struct TCP_Server_Info *server,

				struct smb2_create_rsp *rsp,

				unsigned int *epoch, char *lease_key,

				__u8 *oplock, struct smb2_file_all_info *buf);

int smb2_parse_contexts(struct TCP_Server_Info *server,

			struct kvec *rsp_iov,

			unsigned int *epoch,

			char *lease_key, __u8 *oplock,

			struct smb2_file_all_info *buf);



extern int smb3_encryption_required(const struct cifs_tcon *tcon);

extern int smb2_validate_iov(unsigned int offset, unsigned int buffer_length,

			     struct kvec *iov, unsigned int min_buf_size);