ZhangXiaoxu 4061e662c8 cifs: Fix lease buffer length error ... [ Upstream commit b57a55e220 ] There is a KASAN slab-out-of-bounds: BUG: KASAN: slab-out-of-bounds in _copy_from_iter_full+0x783/0xaa0 Read of size 80 at addr ffff88810c35e180 by task mount.cifs/539 CPU: 1 PID: 539 Comm: mount.cifs Not tainted 4.19 #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0xdd/0x12a print_address_description+0xa7/0x540 kasan_report+0x1ff/0x550 check_memory_region+0x2f1/0x310 memcpy+0x2f/0x80 _copy_from_iter_full+0x783/0xaa0 tcp_sendmsg_locked+0x1840/0x4140 tcp_sendmsg+0x37/0x60 inet_sendmsg+0x18c/0x490 sock_sendmsg+0xae/0x130 smb_send_kvec+0x29c/0x520 __smb_send_rqst+0x3ef/0xc60 smb_send_rqst+0x25a/0x2e0 compound_send_recv+0x9e8/0x2af0 cifs_send_recv+0x24/0x30 SMB2_open+0x35e/0x1620 open_shroot+0x27b/0x490 smb2_open_op_close+0x4e1/0x590 smb2_query_path_info+0x2ac/0x650 cifs_get_inode_info+0x1058/0x28f0 cifs_root_iget+0x3bb/0xf80 cifs_smb3_do_mount+0xe00/0x14c0 cifs_do_mount+0x15/0x20 mount_fs+0x5e/0x290 vfs_kern_mount+0x88/0x460 do_mount+0x398/0x31e0 ksys_mount+0xc6/0x150 __x64_sys_mount+0xea/0x190 do_syscall_64+0x122/0x590 entry_SYSCALL_64_after_hwframe+0x44/0xa9 It can be reproduced by the following step: 1. samba configured with: server max protocol = SMB2_10 2. mount -o vers=default When parse the mount version parameter, the 'ops' and 'vals' was setted to smb30, if negotiate result is smb21, just update the 'ops' to smb21, but the 'vals' is still smb30. When add lease context, the iov_base is allocated with smb21 ops, but the iov_len is initiallited with the smb30. Because the iov_len is longer than iov_base, when send the message, copy array out of bounds. we need to keep the 'ops' and 'vals' consistent. Fixes: 9764c02fcb ("SMB3: Add support for multidialect negotiate (SMB2.1 and later)") Fixes: d5c7076b77 ("smb3: add smb3.1.1 to default dialect list") Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com> Signed-off-by: Steve French <stfrench@microsoft.com> CC: Stable <stable@vger.kernel.org> Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-09-16 08:22:10 +02:00
..
9p	9p: pass the correct prototype to read_cache_page	2019-07-31 07:27:08 +02:00
adfs	fs/adfs: super: fix use-after-free bug	2019-08-06 19:06:49 +02:00
affs
afs	afs: Fix leak in afs_lookup_cell_rcu()	2019-09-10 10:33:52 +01:00
autofs	autofs: fix error return in autofs_fill_super()	2019-03-13 14:02:32 -07:00
befs	fix a series of Documentation/ broken file name references	2018-06-15 18:10:01 -03:00
bfs	bfs: add sanity check at bfs_fill_super()	2018-12-01 09:37:27 +01:00
btrfs	btrfs: init csum_list before possible free	2019-09-16 08:22:08 +02:00
cachefiles	fscache, cachefiles: remove redundant variable 'cache'	2018-12-17 09:24:40 +01:00
ceph	ceph: fix buffer free while holding i_ceph_lock in fill_inode()	2019-09-10 10:33:52 +01:00
cifs	cifs: Fix lease buffer length error	2019-09-16 08:22:10 +02:00
coda	coda: add error handling for fget	2019-08-06 19:06:51 +02:00
configfs	configfs: Fix use-after-free when accessing sd->s_dentry	2019-06-22 08:15:17 +02:00
cramfs	Cramfs: fix abad comparison when wrap-arounds occur	2018-11-13 11:08:55 -08:00
crypto	fscrypt: clean up some BUG_ON()s in block encryption/decryption	2019-07-26 09:14:02 +02:00
debugfs	debugfs: fix use-after-free on symlink traversal	2019-05-08 07:21:48 +02:00
devpts	fs/devpts: always delete dcache dentry-s in dput()	2019-03-23 20:09:59 +01:00
dlm	dlm: check if workqueues are NULL before flushing/destroying	2019-07-31 07:27:07 +02:00
ecryptfs	eCryptfs: fix a couple type promotion bugs	2019-07-26 09:14:29 +02:00
efivarfs	efivars: Call guid_parse() against guid_t type of variable	2018-07-22 14:13:44 +02:00
efs
exofs	fs/exofs: fix potential memory leak in mount option parsing	2018-11-27 16:13:00 +01:00
exportfs	exportfs: do not read dentry after free	2018-12-17 09:24:35 +01:00
ext2	ext2: Fix underflow in ext2_max_size()	2019-03-23 20:10:03 +01:00
ext4	ext4: allow directory holes	2019-07-28 08:29:30 +02:00
f2fs	f2fs: avoid out-of-range memory access	2019-07-31 07:27:07 +02:00
fat	fs/fat/file.c: issue flush after the writeback of FAT	2019-06-15 11:53:59 +02:00
freevxfs
fscache	fscache: fix race between enablement and dropping of object	2018-12-17 09:24:40 +01:00
fuse	fuse: retrieve: cap requested size to negotiated max_write	2019-06-15 11:54:07 +02:00
gfs2	gfs2: gfs2_walk_metadata fix	2019-08-16 10:12:41 +02:00
hfs	hfs: do not free node before using	2018-12-17 09:24:41 +01:00
hfsplus	hfsplus: do not free node before using	2018-12-17 09:24:41 +01:00
hostfs	vfs: discard ATTR_ATTR_FLAG	2018-08-17 16:20:28 -07:00
hpfs	hpfs: remove unnecessary checks on the value of r when assigning error code	2018-08-25 12:42:33 -07:00
hugetlbfs	hugetlb: use same fault hash key for shared and private mappings	2019-05-22 07:37:40 +02:00
isofs	isofs: reject hardware sector size > 2048 bytes	2018-08-21 11:37:41 +02:00
jbd2	jbd2: introduce jbd2_inode dirty range scoping	2019-07-28 08:29:29 +02:00
jffs2	jffs2: fix use-after-free on symlink traversal	2019-05-08 07:21:48 +02:00
jfs	Just one jfs patch for 4.19	2018-08-15 22:47:23 -07:00
kernfs	kernfs: fix barrier usage in __kernfs_new_node()	2019-05-16 19:41:18 +02:00
lockd	Revert "lockd: Show pid of lockd for remote locks"	2019-06-09 09:17:22 +02:00
minix
nfs	NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0	2019-09-06 10:22:23 +02:00
nfs_common
nfsd	nfsd: Fix overflow causing non-working mounts on 1 TB machines	2019-07-10 09:53:47 +02:00
nilfs2	nilfs2: convert to SPDX license tags	2018-09-04 16:45:02 -07:00
nls
notify	memcg, fsnotify: no oom-kill for remote memcg charging	2019-07-31 07:27:08 +02:00
ntfs	ntfs: mft: remove VLA usage	2018-08-17 16:20:27 -07:00
ocfs2	ocfs2: remove set but not used variable 'last_hash'	2019-08-25 10:47:58 +02:00
omfs
openpromfs
orangefs	orangefs: remove redundant pointer orangefs_inode	2018-08-14 12:07:14 -04:00
overlayfs	ovl: fix bogus -Wmaybe-unitialized warning	2019-06-25 11:35:52 +08:00
proc	/proc/<pid>/cmdline: add back the setproctitle() special case	2019-08-04 09:30:56 +02:00
pstore	pstore/ram: Run without kernel crash dump region	2019-06-11 12:20:52 +02:00
qnx4
qnx6
quota	quota: fix a problem about transfer quota	2019-07-14 08:11:15 +02:00
ramfs
reiserfs	reiserfs: propagate errors from fill_with_dentries() properly	2018-11-27 16:12:59 +01:00
romfs
squashfs	Squashfs: Compute expected length from inode size rather than block length	2018-08-02 09:34:02 -07:00
sysfs	Driver core patches for 4.19-rc1	2018-08-18 11:44:53 -07:00
sysv	sysv: return 'err' instead of 0 in __sysv_write_inode	2018-12-17 09:24:30 +01:00
tracefs	tracefs: Annotate tracefs_ops with __ro_after_init	2018-07-31 11:32:44 -04:00
ubifs	ubifs: Handle re-linking of inodes correctly while recovery	2018-12-29 13:37:55 +01:00
udf	udf: Fix incorrect final NOT_ALLOCATED (hole) extent length	2019-07-14 08:11:16 +02:00
ufs	ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour	2019-05-25 18:23:46 +02:00
xfs	xfs: always rejoin held resources during defer roll	2019-08-29 08:28:58 +02:00
aio.c	Fix aio_poll() races	2019-05-02 09:58:59 +02:00
anon_inodes.c	anon_inode_getfile(): switch to alloc_file_pseudo()	2018-07-12 10:04:27 -04:00
attr.c	fs: Fix attr.c kernel-doc	2018-07-03 16:44:45 -04:00
bad_inode.c	get rid of 'opened' argument of ->atomic_open() - part 3	2018-07-12 10:04:20 -04:00
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	Here are the main MIPS changes for 4.19.	2018-08-13 19:24:32 -07:00
binfmt_em86.c
binfmt_flat.c	fs/binfmt_flat.c: make load_flat_shared_library() work	2019-07-03 13:14:44 +02:00
binfmt_misc.c	turn filp_clone_open() into inline wrapper for dentry_open()	2018-07-10 23:29:03 -04:00
binfmt_script.c	Revert "exec: load_script: don't blindly truncate shebang string"	2019-02-15 09:09:54 +01:00
block_dev.c	block: fix the return errno for direct IO	2019-04-17 08:38:52 +02:00
buffer.c	fs: fix guard_bio_eod to check for real EOD errors	2019-04-05 22:33:00 +02:00
char_dev.c	chardev: add additional check for minor range overlap	2019-05-31 06:46:27 -07:00
compat_binfmt_elf.c
compat_ioctl.c	compat_ioctl: pppoe: fix PPPOEIOCSFWD handling	2019-08-09 17:52:34 +02:00
compat.c
coredump.c
d_path.c
dax.c	dax: dax_layout_busy_page() should not unmap cow pages	2019-08-16 10:12:52 +02:00
dcache.c	dcache: sort the freeing-without-RCU-delay mess for good.	2019-05-25 18:23:26 +02:00
dcookies.c
direct-io.c	direct-io: allow direct writes to empty inodes	2019-03-05 17:58:50 +01:00
drop_caches.c	fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()	2019-03-13 14:02:32 -07:00
eventfd.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
eventpoll.c	fs/epoll: drop ovflist branch prediction	2019-02-12 19:47:19 +01:00
exec.c	sched/fair: Don't free p->numa_faults with concurrent readers	2019-08-04 09:30:56 +02:00
fcntl.c	signal: Don't send signals to tasks that don't exist	2018-08-15 23:03:20 -05:00
fhandle.c
file_table.c	overlayfs update for 4.19	2018-08-21 18:19:09 -07:00
file.c	fs/file.c: initialize init_files.resize_wait	2019-04-05 22:32:59 +02:00
filesystems.c
fs_pin.c
fs_struct.c
fs-writeback.c	blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration	2019-07-26 09:14:08 +02:00
inode.c	Abort file_remove_privs() for non-reg. files	2019-06-22 08:15:21 +02:00
internal.h	acct_on(): don't mess with freeze protection	2019-05-31 06:46:05 -07:00
ioctl.c	vfs: fix FIGETBSZ ioctl on an overlayfs file	2018-11-21 09:19:14 +01:00
iomap.c	iomap: fix a use after free in iomap_dio_rw	2019-03-13 14:02:29 -07:00
Kconfig
Kconfig.binfmt	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
libfs.c
locks.c	overlayfs update for 4.19	2018-08-21 18:19:09 -07:00
Makefile
mbcache.c
mount.h
mpage.c	mpage: mpage_readpages() should submit IO as read-ahead	2018-08-17 16:20:29 -07:00
namei.c	Revert "vfs: Allow userns root to call mknod on owned filesystems."	2018-12-29 13:37:54 +01:00
namespace.c	mnt: fix __detach_mounts infinite loop	2018-11-21 09:19:22 +01:00
no-block.c
nsfs.c	dcache: sort the freeing-without-RCU-delay mess for good.	2019-05-25 18:23:26 +02:00
open.c	access: avoid the RCU grace period for the temporary subjective credentials	2019-07-31 07:27:11 +02:00
pipe.c	fs: prevent page refcount overflow in pipe_buf_get	2019-05-04 09:20:11 +02:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	vfs: fix page locking deadlocks when deduping files	2019-09-10 10:33:47 +01:00
readdir.c
select.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
seq_file.c	seq_file: fix problem when seeking mid-record	2019-08-25 10:47:43 +02:00
signalfd.c	Merge branch 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-16 16:21:50 +09:00
splice.c	fs: prevent page refcount overflow in pipe_buf_get	2019-05-04 09:20:11 +02:00
stack.c
stat.c
statfs.c	kernel: add kcompat_sys_{f,}statfs64()	2018-07-12 14:49:48 +01:00
super.c	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
sync.c
timerfd.c	Merge branch 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-08-13 20:56:23 -07:00
userfaultfd.c	userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx	2019-08-29 08:28:52 +02:00
utimes.c
xattr.c	sysfs: Do not return POSIX ACL xattrs via listxattr	2018-09-18 07:30:48 -04:00