github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Browse Source 
Fix several related bounds checking and pointer lifecycle issues in
receive_encrypted_standard()'s handling of compound encrypted frames:

- Clear next_buffer after assigning it to server->bigbuf. A stale
  next_buffer pointer can lead to a use-after-free on subsequent
  error paths.
- Update pdu_length to the decrypted plaintext size (buf_size). Using
  the pre-decryption length allows NextCommand to point into stale
  ciphertext residue.
- Reject next_cmd values smaller than MID_HEADER_SIZE(server).
- Fix an integer overflow in the upper bound check by verifying
  pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the
  trailing slice is large enough for a header.

Fixes: b24df3e30c ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
This commit is contained in:
Frank Sorenson 2026-09-16 16:33:52 -05:00 committed by Paulo Alcantara
parent d034e836ee
commit 05762c5bc1
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
fs/smb/client/smb2ops.c
View File

@ -5365,6 +5365,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
length = decrypt_raw_data(server, buf, buf_size, NULL, false);
if (length)
return length;
pdu_length = buf_size;
next_is_large = server->large_buf;
one_more:
@ -5377,8 +5378,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
}
if (next_cmd) {
if (WARN_ON_ONCE(next_cmd > pdu_length))
if (next_cmd < MID_HEADER_SIZE(server) ||
next_cmd > pdu_length ||
pdu_length - next_cmd < MID_HEADER_SIZE(server)) {
unsigned int max_next = pdu_length > (unsigned int)MID_HEADER_SIZE(server) ?
pdu_length - (unsigned int)MID_HEADER_SIZE(server) : 0;
cifs_server_dbg(VFS, "invalid NextCommand offset %u out of range [%zu, %u]\n",
next_cmd, MID_HEADER_SIZE(server), max_next);
return -1;
}
if (next_is_large)
next_buffer = (char *)cifs_buf_get();
else
@ -5414,6 +5422,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
server->bigbuf = buf = next_buffer;
else
server->smallbuf = buf = next_buffer;
next_buffer = NULL;
goto one_more;
} else if (ret != 0) {
/*