Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2796d303 authored by Long Li's avatar Long Li Committed by Steve French
Browse files

cifs: Allocate validate negotiation request through kmalloc 



The data buffer allocated on the stack can't be DMA'ed, ib_dma_map_page will
return an invalid DMA address for a buffer on stack. Even worse, this
incorrect address can't be detected by ib_dma_mapping_error. Sending data
from this address to hardware will not fail, but the remote peer will get
junk data.

Fix this by allocating the request on the heap in smb3_validate_negotiate.

Changes in v2:
Removed duplicated code on freeing buffers on function exit.
(Thanks to Parav Pandit <parav@mellanox.com>)
Fixed typo in the patch title.

Changes in v3:
Added "Fixes" to the patch.
Changed several sizeof() to use *pointer in place of struct.

Changes in v4:
Added detailed comments on the failure through RDMA.
Allocate request buffer using GPF_NOFS.
Fixed possible memory leak.

Changes in v5:
Removed variable ret for checking return value.
Changed to use pneg_inbuf->Dialects[0] to calculate unused space in pneg_inbuf.

Fixes: ff1c038a ("Check SMB3 dialects against downgrade attacks")
Signed-off-by: default avatarLong Li <longli@microsoft.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: default avatarTom Talpey <ttalpey@microsoft.com>
parent 036db8bd

fs/cifs/smb2pdu.c

+38 −30
Original line number Diff line number Diff line
@@ -730,8 +730,8 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) 


int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)

{

	int rc = 0;

	struct validate_negotiate_info_req vneg_inbuf;

	int rc;

	struct validate_negotiate_info_req *pneg_inbuf;

	struct validate_negotiate_info_rsp *pneg_rsp = NULL;

	u32 rsplen;

	u32 inbuflen; /* max of 4 dialects */
@@ -765,63 +765,69 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 
	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)

		cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");



	vneg_inbuf.Capabilities =

	pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS);

	if (!pneg_inbuf)

		return -ENOMEM;



	pneg_inbuf->Capabilities =

			cpu_to_le32(tcon->ses->server->vals->req_capabilities);

	memcpy(vneg_inbuf.Guid, tcon->ses->server->client_guid,

	memcpy(pneg_inbuf->Guid, tcon->ses->server->client_guid,

					SMB2_CLIENT_GUID_SIZE);



	if (tcon->ses->sign)

		vneg_inbuf.SecurityMode =

		pneg_inbuf->SecurityMode =

			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);

	else if (global_secflags & CIFSSEC_MAY_SIGN)

		vneg_inbuf.SecurityMode =

		pneg_inbuf->SecurityMode =

			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);

	else

		vneg_inbuf.SecurityMode = 0;

		pneg_inbuf->SecurityMode = 0;





	if (strcmp(tcon->ses->server->vals->version_string,

		SMB3ANY_VERSION_STRING) == 0) {

		vneg_inbuf.Dialects[0] = cpu_to_le16(SMB30_PROT_ID);

		vneg_inbuf.Dialects[1] = cpu_to_le16(SMB302_PROT_ID);

		vneg_inbuf.DialectCount = cpu_to_le16(2);

		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);

		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);

		pneg_inbuf->DialectCount = cpu_to_le16(2);

		/* structure is big enough for 3 dialects, sending only 2 */

		inbuflen = sizeof(struct validate_negotiate_info_req) - 2;

		inbuflen = sizeof(*pneg_inbuf) -

				sizeof(pneg_inbuf->Dialects[0]);

	} else if (strcmp(tcon->ses->server->vals->version_string,

		SMBDEFAULT_VERSION_STRING) == 0) {

		vneg_inbuf.Dialects[0] = cpu_to_le16(SMB21_PROT_ID);

		vneg_inbuf.Dialects[1] = cpu_to_le16(SMB30_PROT_ID);

		vneg_inbuf.Dialects[2] = cpu_to_le16(SMB302_PROT_ID);

		vneg_inbuf.DialectCount = cpu_to_le16(3);

		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);

		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);

		pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);

		pneg_inbuf->DialectCount = cpu_to_le16(3);

		/* structure is big enough for 3 dialects */

		inbuflen = sizeof(struct validate_negotiate_info_req);

		inbuflen = sizeof(*pneg_inbuf);

	} else {

		/* otherwise specific dialect was requested */

		vneg_inbuf.Dialects[0] =

		pneg_inbuf->Dialects[0] =

			cpu_to_le16(tcon->ses->server->vals->protocol_id);

		vneg_inbuf.DialectCount = cpu_to_le16(1);

		pneg_inbuf->DialectCount = cpu_to_le16(1);

		/* structure is big enough for 3 dialects, sending only 1 */

		inbuflen = sizeof(struct validate_negotiate_info_req) - 4;

		inbuflen = sizeof(*pneg_inbuf) -

				sizeof(pneg_inbuf->Dialects[0]) * 2;

	}



	rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,

		FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,

		(char *)&vneg_inbuf, sizeof(struct validate_negotiate_info_req),

		(char **)&pneg_rsp, &rsplen);

		(char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen);



	if (rc != 0) {

		cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);

		return -EIO;

		rc = -EIO;

		goto out_free_inbuf;

	}



	if (rsplen != sizeof(struct validate_negotiate_info_rsp)) {

	rc = -EIO;

	if (rsplen != sizeof(*pneg_rsp)) {

		cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n",

			 rsplen);



		/* relax check since Mac returns max bufsize allowed on ioctl */

		if ((rsplen > CIFSMaxBufSize)

		     || (rsplen < sizeof(struct validate_negotiate_info_rsp)))

			goto err_rsp_free;

		if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp))

			goto out_free_rsp;

	}



	/* check validate negotiate info response matches what we got earlier */
@@ -838,15 +844,17 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 
		goto vneg_out;



	/* validate negotiate successful */

	rc = 0;

	cifs_dbg(FYI, "validate negotiate info successful\n");

	kfree(pneg_rsp);

	return 0;

	goto out_free_rsp;



vneg_out:

	cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n");

err_rsp_free:

out_free_rsp:

	kfree(pneg_rsp);

	return -EIO;

out_free_inbuf:

	kfree(pneg_inbuf);

	return rc;

}



enum securityEnum