github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-09 15:12:59 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
Linux kernel source tree
790,863 Commits 1 Branch 934 Tags 20 GiB
C 97%
Assembly 1%
Shell 0.6%
Rust 0.5%
Python 0.4%
Other 0.3%
4061e662c8
Go to file
ZhangXiaoxu 4061e662c8 cifs: Fix lease buffer length error 
[ Upstream commit b57a55e220 ]

There is a KASAN slab-out-of-bounds:
BUG: KASAN: slab-out-of-bounds in _copy_from_iter_full+0x783/0xaa0
Read of size 80 at addr ffff88810c35e180 by task mount.cifs/539

CPU: 1 PID: 539 Comm: mount.cifs Not tainted 4.19 #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
            rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
Call Trace:
 dump_stack+0xdd/0x12a
 print_address_description+0xa7/0x540
 kasan_report+0x1ff/0x550
 check_memory_region+0x2f1/0x310
 memcpy+0x2f/0x80
 _copy_from_iter_full+0x783/0xaa0
 tcp_sendmsg_locked+0x1840/0x4140
 tcp_sendmsg+0x37/0x60
 inet_sendmsg+0x18c/0x490
 sock_sendmsg+0xae/0x130
 smb_send_kvec+0x29c/0x520
 __smb_send_rqst+0x3ef/0xc60
 smb_send_rqst+0x25a/0x2e0
 compound_send_recv+0x9e8/0x2af0
 cifs_send_recv+0x24/0x30
 SMB2_open+0x35e/0x1620
 open_shroot+0x27b/0x490
 smb2_open_op_close+0x4e1/0x590
 smb2_query_path_info+0x2ac/0x650
 cifs_get_inode_info+0x1058/0x28f0
 cifs_root_iget+0x3bb/0xf80
 cifs_smb3_do_mount+0xe00/0x14c0
 cifs_do_mount+0x15/0x20
 mount_fs+0x5e/0x290
 vfs_kern_mount+0x88/0x460
 do_mount+0x398/0x31e0
 ksys_mount+0xc6/0x150
 __x64_sys_mount+0xea/0x190
 do_syscall_64+0x122/0x590
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

It can be reproduced by the following step:
  1. samba configured with: server max protocol = SMB2_10
  2. mount -o vers=default

When parse the mount version parameter, the 'ops' and 'vals'
was setted to smb30,  if negotiate result is smb21, just
update the 'ops' to smb21, but the 'vals' is still smb30.
When add lease context, the iov_base is allocated with smb21
ops, but the iov_len is initiallited with the smb30. Because
the iov_len is longer than iov_base, when send the message,
copy array out of bounds.

we need to keep the 'ops' and 'vals' consistent.

Fixes: 9764c02fcb ("SMB3: Add support for multidialect negotiate (SMB2.1 and later)")
Fixes: d5c7076b77 ("smb3: add smb3.1.1 to default dialect list")

Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-09-16 08:22:10 +02:00
arch KVM: x86: Always use 32-bit SMRAM save state for 32-bit kernels 2019-09-16 08:22:10 +02:00
block blk-iolatency: fix STS_AGAIN handling 2019-09-16 08:21:41 +02:00
certs
crypto crypto: chacha20poly1305 - fix atomic sleep when using async algorithm 2019-07-26 09:14:19 +02:00
Documentation iio: adc: exynos-adc: Use proper number of channels for Exynos4x12 2019-09-16 08:22:06 +02:00
drivers IB/mlx5: Reset access mask when looping inside page fault handler 2019-09-16 08:22:10 +02:00
firmware
fs cifs: Fix lease buffer length error 2019-09-16 08:22:10 +02:00
include drm/vblank: Allow dynamic per-crtc max_vblank_count 2019-09-16 08:22:04 +02:00
init initramfs: free initrd memory if opening /initrd.image fails 2019-06-15 11:54:01 +02:00
ipc ipc/mqueue.c: only perform resource calculation if user valid 2019-08-06 19:06:52 +02:00
kernel kernel/module: Fix mem leak in module_add_modinfo_attrs 2019-09-16 08:21:45 +02:00
lib lib: logic_pio: Add logic_pio_unregister_range() 2019-09-06 10:22:19 +02:00
LICENSES
mm mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n 2019-09-06 10:22:08 +02:00
net {nl,mac}80211: fix interface combinations on crypto controlled devices 2019-09-16 08:21:42 +02:00
samples samples, bpf: suppress compiler warning 2019-07-14 08:11:04 +02:00
scripts scripts/decode_stacktrace: match basepath using shell prefix operator, not regex 2019-09-16 08:21:44 +02:00
security selinux: fix memory leak in policydb_init() 2019-08-06 19:06:54 +02:00
sound ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre 2019-09-16 08:21:40 +02:00
tools selftests: fib_rule_tests: use pre-defined DEV_ADDR 2019-09-16 08:21:42 +02:00
usr
virt KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity 2019-09-10 10:33:53 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 4.19.72 2019-09-10 10:33:54 +01:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.