[v6,00/14] Buffer validation patches

Message

Ralph Boehme Oct. 2, 2021, 1:11 p.m. UTC

v2:
  - update comments of smb2_get_data_area_len().
  - fix wrong buffer size check in fsctl_query_iface_info_ioctl().
  - fix 32bit overflow in smb2_set_info.

v3:
  - add buffer check for ByteCount of smb negotiate request.
  - Moved buffer check of to the top of loop to avoid unneeded behavior when
    out_buf_len is smaller than network_interface_info_ioctl_rsp.
  - get correct out_buf_len which doesn't exceed max stream protocol length.
  - subtract single smb2_lock_element for correct buffer size check in
    ksmbd_smb2_check_message().

v4: 
  - use work->response_sz for out_buf_len calculation in smb2_ioctl.
  - move smb2_neg size check to above to validate NegotiateContextOffset
    field.
  - remove unneeded dialect checks in smb2_sess_setup() and
    smb2_handle_negotiate().
  - split smb2_set_info patch into two patches(declaring
    smb2_file_basic_info and buffer check) 

v5:
  - remove PDU size validation from ksmbd_conn_handler_loop()
  - add PDU size validation to ksmbd_smb2_check_message()
  - fix compound non-related request handling

v6:
  - check we can access ProtocolId in ksmbd_verify_smb_message()
  - optimize tcon and session check functions for compound related PDUs
  - drop patch that broke SMB1 negprot
  - check credits after fully validating PDU size

Namjae Jeon (4):
  ksmbd: add the check to vaildate if stream protocol length exceeds
    maximum value
  ksmbd: add validation in smb2_ioctl
  ksmbd: check strictly data area in ksmbd_smb2_check_message()
  ksmbd: remove the leftover of smb2.0 dialect support

Ralph Boehme (10):
  ksmbd: use ksmbd_req_buf_next() in ksmbd_verify_smb_message()
  ksmbd: check buffer is big enough to access the ProtocolId field
  ksmbd: use ksmbd_req_buf_next() in ksmbd_smb2_check_message()
  ksmbd: use ksmbd_smb2_cur_pdu_buflen() in ksmbd_smb2_check_message()
  ksmbd: check PDU len is at least header plus body size in
    ksmbd_smb2_check_message()
  ksmdb: use cmd helper variable in smb2_get_ksmbd_tcon()
  ksmdb: make smb2_get_ksmbd_tcon() callable with chained PDUs
  ksmbd: make smb2_check_user_session() callable for compound PDUs
  ksmdb: move session and tcon validation to ksmbd_smb2_check_message()
  ksmdb: validate credit charge after validating SMB2 PDU body size

 fs/ksmbd/connection.c |   9 ++-
 fs/ksmbd/ksmbd_work.h |   1 +
 fs/ksmbd/server.c     |  46 +++++++----
 fs/ksmbd/smb2misc.c   | 152 +++++++++++++++++++-----------------
 fs/ksmbd/smb2ops.c    |   5 --
 fs/ksmbd/smb2pdu.c    | 178 +++++++++++++++++++++++++++++-------------
 fs/ksmbd/smb2pdu.h    |   2 +-
 fs/ksmbd/smb_common.c |  22 +++---
 fs/ksmbd/smb_common.h |   4 +-
 fs/ksmbd/vfs.c        |   2 +-
 fs/ksmbd/vfs.h        |   2 +-
 11 files changed, 256 insertions(+), 167 deletions(-)