Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1eaac174 authored by Pavel Shilovsky's avatar Pavel Shilovsky Committed by Sasha Levin
Browse files

CIFS: Fix a possible invalid memory access in smb2_query_symlink() 



[ Upstream commit 7893242e2465aea6f2cbc2639da8fa5ce96e8cc2 ]

During following a symbolic link we received err_buf from SMB2_open().
While the validity of SMB2 error response is checked previously
in smb2_check_message() a symbolic link payload is not checked at all.
Fix it by adding such checks.

Cc: Dan Carpenter <dan.carpenter@oracle.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: default avatarPavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent a10e07c7

fs/cifs/smb2ops.c

+29 −1
Original line number Diff line number Diff line
@@ -972,6 +972,9 @@ smb2_new_lease_key(struct cifs_fid *fid) 
	get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);

}



#define SMB2_SYMLINK_STRUCT_SIZE \

	(sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp))



static int

smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,

		   const char *full_path, char **target_path,
@@ -984,7 +987,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, 
	struct cifs_fid fid;

	struct smb2_err_rsp *err_buf = NULL;

	struct smb2_symlink_err_rsp *symlink;

	unsigned int sub_len, sub_offset;

	unsigned int sub_len;

	unsigned int sub_offset;

	unsigned int print_len;

	unsigned int print_offset;



	cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path);
@@ -1005,11 +1011,33 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, 
		kfree(utf16_path);

		return -ENOENT;

	}



	if (le32_to_cpu(err_buf->ByteCount) < sizeof(struct smb2_symlink_err_rsp) ||

	    get_rfc1002_length(err_buf) + 4 < SMB2_SYMLINK_STRUCT_SIZE) {

		kfree(utf16_path);

		return -ENOENT;

	}



	/* open must fail on symlink - reset rc */

	rc = 0;

	symlink = (struct smb2_symlink_err_rsp *)err_buf->ErrorData;

	sub_len = le16_to_cpu(symlink->SubstituteNameLength);

	sub_offset = le16_to_cpu(symlink->SubstituteNameOffset);

	print_len = le16_to_cpu(symlink->PrintNameLength);

	print_offset = le16_to_cpu(symlink->PrintNameOffset);



	if (get_rfc1002_length(err_buf) + 4 <

			SMB2_SYMLINK_STRUCT_SIZE + sub_offset + sub_len) {

		kfree(utf16_path);

		return -ENOENT;

	}



	if (get_rfc1002_length(err_buf) + 4 <

			SMB2_SYMLINK_STRUCT_SIZE + print_offset + print_len) {

		kfree(utf16_path);

		return -ENOENT;

	}



	*target_path = cifs_strndup_from_utf16(

				(char *)symlink->PathBuffer + sub_offset,

				sub_len, true, cifs_sb->local_nls);