• Z
    cifs: Fix lease buffer length error · 4061e662
    ZhangXiaoxu 提交于
    [ Upstream commit b57a55e2200ede754e4dc9cce4ba9402544b9365 ]
    
    There is a KASAN slab-out-of-bounds:
    BUG: KASAN: slab-out-of-bounds in _copy_from_iter_full+0x783/0xaa0
    Read of size 80 at addr ffff88810c35e180 by task mount.cifs/539
    
    CPU: 1 PID: 539 Comm: mount.cifs Not tainted 4.19 #10
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
                rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
    Call Trace:
     dump_stack+0xdd/0x12a
     print_address_description+0xa7/0x540
     kasan_report+0x1ff/0x550
     check_memory_region+0x2f1/0x310
     memcpy+0x2f/0x80
     _copy_from_iter_full+0x783/0xaa0
     tcp_sendmsg_locked+0x1840/0x4140
     tcp_sendmsg+0x37/0x60
     inet_sendmsg+0x18c/0x490
     sock_sendmsg+0xae/0x130
     smb_send_kvec+0x29c/0x520
     __smb_send_rqst+0x3ef/0xc60
     smb_send_rqst+0x25a/0x2e0
     compound_send_recv+0x9e8/0x2af0
     cifs_send_recv+0x24/0x30
     SMB2_open+0x35e/0x1620
     open_shroot+0x27b/0x490
     smb2_open_op_close+0x4e1/0x590
     smb2_query_path_info+0x2ac/0x650
     cifs_get_inode_info+0x1058/0x28f0
     cifs_root_iget+0x3bb/0xf80
     cifs_smb3_do_mount+0xe00/0x14c0
     cifs_do_mount+0x15/0x20
     mount_fs+0x5e/0x290
     vfs_kern_mount+0x88/0x460
     do_mount+0x398/0x31e0
     ksys_mount+0xc6/0x150
     __x64_sys_mount+0xea/0x190
     do_syscall_64+0x122/0x590
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    It can be reproduced by the following step:
      1. samba configured with: server max protocol = SMB2_10
      2. mount -o vers=default
    
    When parse the mount version parameter, the 'ops' and 'vals'
    was setted to smb30,  if negotiate result is smb21, just
    update the 'ops' to smb21, but the 'vals' is still smb30.
    When add lease context, the iov_base is allocated with smb21
    ops, but the iov_len is initiallited with the smb30. Because
    the iov_len is longer than iov_base, when send the message,
    copy array out of bounds.
    
    we need to keep the 'ops' and 'vals' consistent.
    
    Fixes: 9764c02f ("SMB3: Add support for multidialect negotiate (SMB2.1 and later)")
    Fixes: d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
    Signed-off-by: NZhangXiaoxu <zhangxiaoxu5@huawei.com>
    Signed-off-by: NSteve French <stfrench@microsoft.com>
    CC: Stable <stable@vger.kernel.org>
    Reviewed-by: NPavel Shilovsky <pshilov@microsoft.com>
    Signed-off-by: NSasha Levin <sashal@kernel.org>
    4061e662
smb2pdu.c 121.4 KB