Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1358422
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.2.y-ckt 34/98] cifs: fix out-of-bounds access in lease parsing |
| Date | 2016-03-16 01:00 +0100 |
| Message-ID | <rd72y-M3-25@gated-at.bofh.it> (permalink) |
| References | <rd6Jb-EH-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.2.8-ckt6 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Justin Maggard <jmaggard10@gmail.com>
commit deb7deff2f00bdbbcb3d560dad2a89ef37df837d upstream.
When opening a file, SMB2_open() attempts to parse the lease state from the
SMB2 CREATE Response. However, the parsing code was not careful to ensure
that the create contexts are not empty or invalid, which can lead to out-
of-bounds memory access. This can be seen easily by trying
to read a file from a OSX 10.11 SMB3 server. Here is sample crash output:
BUG: unable to handle kernel paging request at ffff8800a1a77cc6
IP: [<ffffffff8828a734>] SMB2_open+0x804/0x960
PGD 8f77067 PUD 0
Oops: 0000 [#1] SMP
Modules linked in:
CPU: 3 PID: 2876 Comm: cp Not tainted 4.5.0-rc3.x86_64.1+ #14
Hardware name: NETGEAR ReadyNAS 314 /ReadyNAS 314 , BIOS 4.6.5 10/11/2012
task: ffff880073cdc080 ti: ffff88005b31c000 task.ti: ffff88005b31c000
RIP: 0010:[<ffffffff8828a734>] [<ffffffff8828a734>] SMB2_open+0x804/0x960
RSP: 0018:ffff88005b31fa08 EFLAGS: 00010282
RAX: 0000000000000015 RBX: 0000000000000000 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff88007eb8c8b0
RBP: ffff88005b31fad8 R08: 666666203d206363 R09: 6131613030383866
R10: 3030383866666666 R11: 00000000000002b0 R12: ffff8800660fd800
R13: ffff8800a1a77cc2 R14: 00000000424d53fe R15: ffff88005f5a28c0
FS: 00007f7c8a2897c0(0000) GS:ffff88007eb80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff8800a1a77cc6 CR3: 000000005b281000 CR4: 00000000000006e0
Stack:
ffff88005b31fa70 ffffffff88278789 00000000000001d3 ffff88005f5a2a80
ffffffff00000003 ffff88005d029d00 ffff88006fde05a0 0000000000000000
ffff88005b31fc78 ffff88006fde0780 ffff88005b31fb2f 0000000100000fe0
Call Trace:
[<ffffffff88278789>] ? cifsConvertToUTF16+0x159/0x2d0
[<ffffffff8828cf68>] smb2_open_file+0x98/0x210
[<ffffffff8811e80c>] ? __kmalloc+0x1c/0xe0
[<ffffffff882685f4>] cifs_open+0x2a4/0x720
[<ffffffff88122cef>] do_dentry_open+0x1ff/0x310
[<ffffffff88268350>] ? cifsFileInfo_get+0x30/0x30
[<ffffffff88123d92>] vfs_open+0x52/0x60
[<ffffffff88131dd0>] path_openat+0x170/0xf70
[<ffffffff88097d48>] ? remove_wait_queue+0x48/0x50
[<ffffffff88133a29>] do_filp_open+0x79/0xd0
[<ffffffff8813f2ca>] ? __alloc_fd+0x3a/0x170
[<ffffffff881240c4>] do_sys_open+0x114/0x1e0
[<ffffffff881241a9>] SyS_open+0x19/0x20
[<ffffffff8896e257>] entry_SYSCALL_64_fastpath+0x12/0x6a
Code: 4d 8d 6c 07 04 31 c0 4c 89 ee e8 47 6f e5 ff 31 c9 41 89 ce 44 89 f1 48 c7 c7 28 b1 bd 88 31 c0 49 01 cd 4c 89 ee e8 2b 6f e5 ff <45> 0f b7 75 04 48 c7 c7 31 b1 bd 88 31 c0 4d 01 ee 4c 89 f6 e8
RIP [<ffffffff8828a734>] SMB2_open+0x804/0x960
RSP <ffff88005b31fa08>
CR2: ffff8800a1a77cc6
---[ end trace d9f69ba64feee469 ]---
Signed-off-by: Justin Maggard <jmaggard@netgear.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/cifs/smb2pdu.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 60dd831..e543e6a 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1101,21 +1101,25 @@ parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp,
{
char *data_offset;
struct create_context *cc;
- unsigned int next = 0;
+ unsigned int next;
+ unsigned int remaining;
char *name;
data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset);
+ remaining = le32_to_cpu(rsp->CreateContextsLength);
cc = (struct create_context *)data_offset;
- do {
- cc = (struct create_context *)((char *)cc + next);
+ while (remaining >= sizeof(struct create_context)) {
name = le16_to_cpu(cc->NameOffset) + (char *)cc;
- if (le16_to_cpu(cc->NameLength) != 4 ||
- strncmp(name, "RqLs", 4)) {
- next = le32_to_cpu(cc->Next);
- continue;
- }
- return server->ops->parse_lease_buf(cc, epoch);
- } while (next != 0);
+ if (le16_to_cpu(cc->NameLength) == 4 &&
+ strncmp(name, "RqLs", 4) == 0)
+ return server->ops->parse_lease_buf(cc, epoch);
+
+ next = le32_to_cpu(cc->Next);
+ if (!next)
+ break;
+ remaining -= next;
+ cc = (struct create_context *)((char *)cc + next);
+ }
return 0;
}
--
2.7.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[4.2.y-ckt stable] Linux 4.2.8-ckt6 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 21/98] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 87/98] tcp: fix tcpi_segs_in after connection establishment Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 65/98] ovl: fix getcwd() failure after unsuccessful rmdir Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 89/98] tcp: convert cached rtt from usec to jiffies when feeding initial rto Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 08/98] mac80211: minstrel: Change expected throughput unit back to Kbps Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 88/98] be2net: Don't leak iomapped memory on removal. Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 83/98] MIPS: Fix build error when SMP is used without GIC Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 93/98] ipv6: re-enable fragment header matching in ipv6_find_hdr Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 82/98] dmaengine: at_xdmac: fix residue computation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 60/98] drm/radeon/pm: update current crtc info after setting the powerstate Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 85/98] dmaengine: pxa_dma: fix cyclic transfers Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 37/98] arm/arm64: KVM: Fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 94/98] net/mlx5e: Remove wrong poll CQ optimization Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 77/98] jffs2: reduce the breakage on recovery from halfway failed rename() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 86/98] MIPS: smp.c: Fix uninitialised temp_foreign_map Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 98/98] mld, igmp: Fix reserved tailroom calculation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 63/98] ALSA: hda - Fix mic issues on Acer Aspire E1-472 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 76/98] ncpfs: fix a braino in OOM handling in ncp_fill_cache() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 70/98] target: Drop incorrect ABORT_TASK put for completed commands Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 58/98] USB: qcserial: add Sierra Wireless EM74xx device ID Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 50/98] USB: serial: option: add support for Quectel UC20 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 79/98] arm64: account for sparsemem section alignment when choosing vmemmap offset Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 61/98] drm/amdgpu: return from atombios_dp_get_dpcd only when error Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 80/98] tracing: Fix check for cpu online when event is disabled Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 47/98] ASoC: wm8994: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 44/98] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 45/98] ASoC: dapm: Fix ctl value accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 57/98] drm/ast: Fix incorrect register check for DRAM width Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 46/98] ASoC: wm8958: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 49/98] USB: serial: option: add support for Telit LE922 PID 0x1045 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 59/98] drm/amdgpu/pm: update current crtc info after setting the powerstate Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 48/98] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 42/98] use ->d_seq to get coherency between ->d_inode and ->d_flags Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 54/98] i2c: brcmstb: allocate correct amount of memory for regmap Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 56/98] parisc: Fix ptrace syscall number and return value modification Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 66/98] ovl: ignore lower entries when checking purity of non-directory entries Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 51/98] ALSA: usb-audio: Add a quirk for Plantronics DA45 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 72/98] ARM: dts: dra7: do not gate cpsw clock due to errata i877 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 43/98] USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3) Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 78/98] KVM: VMX: disable PEBS before a guest entry Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 68/98] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 71/98] ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 62/98] PM / sleep / x86: Fix crash on graph trace through x86 suspend Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 55/98] ALSA: seq: oss: Don't drain at closing a client Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 73/98] PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 41/98] ALSA: hdsp: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 52/98] mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 81/98] KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 29/98] ALSA: ctl: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 26/98] KVM: x86: fix root cause for missed hardware breakpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 10/98] iwlwifi: mvm: inc pending frames counter also when txing non-sta Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 35/98] CIFS: Fix SMB2+ interim response processing for read requests Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 16/98] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 02/98] tipc: fix nullptr crash during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 09/98] libata: fix HDIO_GET_32BIT ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 39/98] ALSA: hdspm: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 18/98] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 27/98] arm64: vmemmap: use virtual projection of linear region Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 06/98] cfg80211/wext: fix message ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 34/98] cifs: fix out-of-bounds access in lease parsing Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 40/98] ALSA: hdspm: Fix zero-division Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 22/98] iommu/amd: Apply workaround for ATS write permission check Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 13/98] ahci: Order SATA device IDs for codename Lewisburg Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 04/98] Input: aiptek - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 01/98] tipc: fix connection abort during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 31/98] ALSA: rawmidi: Fix ioctls X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 14/98] Adding Intel Lewisburg device IDs for SATA Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 05/98] wext: fix message delay/ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 07/98] mac80211: fix use of uninitialised values in RX aggregation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 11/98] [media] adv7604: fix tx 5v detect regression Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 20/98] Fix directory hardlinks from deleted directories Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 25/98] fbcon: set a default value to blink interval Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 23/98] libata: Align ata_device's id on a cacheline Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 30/98] ALSA: pcm: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 33/98] ALSA: timer: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 38/98] MIPS: kvm: Fix ioctl error handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 28/98] vfio: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 17/98] usb: chipidea: otg: change workqueue ci_otg as freezable Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 36/98] Fix cifs_uniqueid_to_ino_t() function for s390x Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 24/98] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
csiph-web