Commit 3a5af36b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag '4.19-rc3-smb3-cifs' of git://git.samba.org/sfrench/cifs-2.6 

Pull cifs fixes from Steve French:
 "Fixes for four CIFS/SMB3 potential pointer overflow issues, one minor
  build fix, and a build warning cleanup"

* tag '4.19-rc3-smb3-cifs' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: read overflow in is_valid_oplock_break()
  cifs: integer overflow in in SMB2_ioctl()
  CIFS: fix wrapping bugs in num_entries()
  cifs: prevent integer overflow in nxt_dir_entry()
  fs/cifs: require sha512
  fs/cifs: suppress a string overflow warning
parents 589109df 097f5863

fs/cifs/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ config CIFS 
	select CRYPTO_MD4

	select CRYPTO_MD5

	select CRYPTO_SHA256

	select CRYPTO_SHA512

	select CRYPTO_CMAC

	select CRYPTO_HMAC

	select CRYPTO_ARC4

fs/cifs/cifssmb.c

+8 −3
Original line number Diff line number Diff line
@@ -601,10 +601,15 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses) 
	}



	count = 0;

	/*

	 * We know that all the name entries in the protocols array

	 * are short (< 16 bytes anyway) and are NUL terminated.

	 */

	for (i = 0; i < CIFS_NUM_PROT; i++) {

		strncpy(pSMB->DialectsArray+count, protocols[i].name, 16);

		count += strlen(protocols[i].name) + 1;

		/* null at end of source and target buffers anyway */

		size_t len = strlen(protocols[i].name) + 1;



		memcpy(pSMB->DialectsArray+count, protocols[i].name, len);

		count += len;

	}

	inc_rfc1001_len(pSMB, count);

	pSMB->ByteCount = cpu_to_le16(count);

fs/cifs/misc.c

+8 −0
Original line number Diff line number Diff line
@@ -402,9 +402,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) 
			(struct smb_com_transaction_change_notify_rsp *)buf;

		struct file_notify_information *pnotify;

		__u32 data_offset = 0;

		size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length);



		if (get_bcc(buf) > sizeof(struct file_notify_information)) {

			data_offset = le32_to_cpu(pSMBr->DataOffset);



			if (data_offset >

			    len - sizeof(struct file_notify_information)) {

				cifs_dbg(FYI, "invalid data_offset %u\n",

					 data_offset);

				return true;

			}

			pnotify = (struct file_notify_information *)

				((char *)&pSMBr->hdr.Protocol + data_offset);

			cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n",

fs/cifs/readdir.c

+9 −2
Original line number Diff line number Diff line
@@ -376,8 +376,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) 


		new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) +

				pfData->FileNameLength;

	} else

		new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset);

	} else {

		u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset);



		if (old_entry + next_offset < old_entry) {

			cifs_dbg(VFS, "invalid offset %u\n", next_offset);

			return NULL;

		}

		new_entry = old_entry + next_offset;

	}

	cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry);

	/* validate that new_entry is not past end of SMB */

	if (new_entry >= end_of_smb) {

fs/cifs/smb2pdu.c

+17 −12
Original line number Diff line number Diff line
@@ -2459,14 +2459,14 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 
	/* We check for obvious errors in the output buffer length and offset */

	if (*plen == 0)

		goto ioctl_exit; /* server returned no data */

	else if (*plen > 0xFF00) {

	else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) {

		cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);

		*plen = 0;

		rc = -EIO;

		goto ioctl_exit;

	}



	if (rsp_iov.iov_len < le32_to_cpu(rsp->OutputOffset) + *plen) {

	if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) {

		cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,

			le32_to_cpu(rsp->OutputOffset));

		*plen = 0;
@@ -3577,33 +3577,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) 
	int len;

	unsigned int entrycount = 0;

	unsigned int next_offset = 0;

	FILE_DIRECTORY_INFO *entryptr;

	char *entryptr;

	FILE_DIRECTORY_INFO *dir_info;



	if (bufstart == NULL)

		return 0;



	entryptr = (FILE_DIRECTORY_INFO *)bufstart;

	entryptr = bufstart;



	while (1) {

		entryptr = (FILE_DIRECTORY_INFO *)

					((char *)entryptr + next_offset);



		if ((char *)entryptr + size > end_of_buf) {

		if (entryptr + next_offset < entryptr ||

		    entryptr + next_offset > end_of_buf ||

		    entryptr + next_offset + size > end_of_buf) {

			cifs_dbg(VFS, "malformed search entry would overflow\n");

			break;

		}



		len = le32_to_cpu(entryptr->FileNameLength);

		if ((char *)entryptr + len + size > end_of_buf) {

		entryptr = entryptr + next_offset;

		dir_info = (FILE_DIRECTORY_INFO *)entryptr;



		len = le32_to_cpu(dir_info->FileNameLength);

		if (entryptr + len < entryptr ||

		    entryptr + len > end_of_buf ||

		    entryptr + len + size > end_of_buf) {

			cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",

				 end_of_buf);

			break;

		}



		*lastentry = (char *)entryptr;

		*lastentry = entryptr;

		entrycount++;



		next_offset = le32_to_cpu(entryptr->NextEntryOffset);

		next_offset = le32_to_cpu(dir_info->NextEntryOffset);

		if (!next_offset)

			break;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE