Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ee25c6dd authored by Shirish Pargaonkar's avatar Shirish Pargaonkar Committed by Steve French
Browse files

cifs: For SMB2 security informaion query, check for minimum sized security... 

cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class

Validate_buf () function checks for an expected minimum sized response
passed to query_info() function.
For security information, the size of a security descriptor can be
smaller (one subauthority, no ACEs) than the size of the structure
that defines FileInfoClass of FileAllInformation.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199725


Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarShirish Pargaonkar <shirishpargaonkar@gmail.com>
Reviewed-by: default avatarNoah Morrison <noah.morrison@rubrik.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 57f933ce

fs/cifs/cifsacl.h

+14 −0
Original line number Diff line number Diff line
@@ -98,4 +98,18 @@ struct cifs_ace { 
	struct cifs_sid sid; /* ie UUID of user or group who gets these perms */

} __attribute__((packed));



/*

 * Minimum security identifier can be one for system defined Users

 * and Groups such as NULL SID and World or Built-in accounts such

 * as Administrator and Guest and consists of

 * Revision + Num (Sub)Auths + Authority + Domain (one Subauthority)

 */

#define MIN_SID_LEN  (1 + 1 + 6 + 4) /* in bytes */



/*

 * Minimum security descriptor can be one without any SACL and DACL and can

 * consist of revision, type, and two sids of minimum size for owner and group

 */

#define MIN_SEC_DESC_LEN  (sizeof(struct cifs_ntsd) + (2 * MIN_SID_LEN))



#endif /* _CIFSACL_H */

fs/cifs/smb2pdu.c

+1 −2
Original line number Diff line number Diff line
@@ -2492,8 +2492,7 @@ SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 


	return query_info(xid, tcon, persistent_fid, volatile_fid,

			  0, SMB2_O_INFO_SECURITY, additional_info,

			  SMB2_MAX_BUFFER_SIZE,

			  sizeof(struct smb2_file_all_info), data, plen);

			  SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen);

}



int