From patchwork Tue Sep 21 12:41:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Namjae Jeon X-Patchwork-Id: 12507783 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF595C433EF for ; Tue, 21 Sep 2021 12:41:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A73B661100 for ; Tue, 21 Sep 2021 12:41:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232858AbhIUMnT (ORCPT ); Tue, 21 Sep 2021 08:43:19 -0400 Received: from mail-pg1-f179.google.com ([209.85.215.179]:37530 "EHLO mail-pg1-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232882AbhIUMnQ (ORCPT ); Tue, 21 Sep 2021 08:43:16 -0400 Received: by mail-pg1-f179.google.com with SMTP id 17so20573574pgp.4 for ; Tue, 21 Sep 2021 05:41:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=OgUSJFDCxfO+zJiv7fiOqhQzlx1nbgY517uQ/d2YFvg=; b=RVfIUct0aGcLZ9f7Ttxum/y40r0oyO6oOn/Ypedrkvaoi3nNdPwcOPpPp88z2zYTV6 q6v/fbNcTDa6IeFCwyvMZbhGQmtjkd8ovQgCdAm1cAvDt+raFYax7kaUpB9bx2k9d4ZC ZYMlxn3U18LK/0mzSX7Mra8J4f39I+koyVQIj4J1bSCCg03uwF3e8ZfDt3FxEzK7R9MZ s12PGO2/bpqGLH+fhDzCqZ3p+Ydr0BcNKwFfoyd3Y1ifjsEFxbrw8LFGiTJSmyVkMecO 6eTwhDRU8M5v9ogbm9LwvogEq5m+Poix4mrWUZCdklyHKiT/U8noZ5WeZPovPeP19YYu ntfg== X-Gm-Message-State: AOAM531IABXOcgHLtD+msJm/3GEz6IQ3NDbJ8bSfbz5xSkGzMnjJc+zK H4ZSAWUqnCaB12z1JtczV1wedvXTxzexaw== X-Google-Smtp-Source: ABdhPJwHFOBhoF9SDFfqUwqwfGjjFsVho0F+gz5Nc4J5gRGJH84gOIezg2sYiCSQQw/eZXM+ElSkxQ== X-Received: by 2002:a63:7b54:: with SMTP id k20mr15007039pgn.137.1632228107710; Tue, 21 Sep 2021 05:41:47 -0700 (PDT) Received: from localhost.localdomain ([61.74.27.164]) by smtp.gmail.com with ESMTPSA id a11sm17248354pfo.31.2021.09.21.05.41.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Sep 2021 05:41:47 -0700 (PDT) From: Namjae Jeon To: linux-cifs@vger.kernel.org Cc: Ronnie Sahlberg , Ronnie Sahlberg , =?utf-8?q?Ralph_B=C3=B6hme?= , Steve French , Namjae Jeon Subject: [PATCH 1/3] ksmbd: remove RFC1002 check in smb2 request Date: Tue, 21 Sep 2021 21:41:37 +0900 Message-Id: <20210921124139.18312-1-linkinjeon@kernel.org> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org From: Ronnie Sahlberg In smb_common.c you have this function : ksmbd_smb_request() which is called from connection.c once you have read the initial 4 bytes for the next length+smb2 blob. It checks the first byte of this 4 byte preamble for valid values, i.e. a NETBIOSoverTCP SESSION_MESSAGE or a SESSION_KEEP_ALIVE. We don't need to check this for ksmbd since it only implements SMB2 over TCP port 445. The netbios stuff was only used in very old servers when SMB ran over TCP port 139. Now that we run over TCP port 445, this is actually not a NB header anymore and you can just treat it as a 4 byte length field that must be less than 16Mbyte. and remove the references to the RFC1002 constants that no longer applies. Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Steve French Signed-off-by: Ronnie Sahlberg Signed-off-by: Namjae Jeon --- fs/ksmbd/smb_common.c | 15 +-------------- fs/ksmbd/smb_common.h | 8 -------- 2 files changed, 1 insertion(+), 22 deletions(-) diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c index 43d3123d8b62..1da67217698d 100644 --- a/fs/ksmbd/smb_common.c +++ b/fs/ksmbd/smb_common.c @@ -149,20 +149,7 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work) */ bool ksmbd_smb_request(struct ksmbd_conn *conn) { - int type = *(char *)conn->request_buf; - - switch (type) { - case RFC1002_SESSION_MESSAGE: - /* Regular SMB request */ - return true; - case RFC1002_SESSION_KEEP_ALIVE: - ksmbd_debug(SMB, "RFC 1002 session keep alive\n"); - break; - default: - ksmbd_debug(SMB, "RFC 1002 unknown request type 0x%x\n", type); - } - - return false; + return conn->request_buf[0] == 0; } static bool supported_protocol(int idx) diff --git a/fs/ksmbd/smb_common.h b/fs/ksmbd/smb_common.h index 57c667c1be06..d7df19c97c4c 100644 --- a/fs/ksmbd/smb_common.h +++ b/fs/ksmbd/smb_common.h @@ -48,14 +48,6 @@ #define CIFS_DEFAULT_IOSIZE (64 * 1024) #define MAX_CIFS_SMALL_BUFFER_SIZE 448 /* big enough for most */ -/* RFC 1002 session packet types */ -#define RFC1002_SESSION_MESSAGE 0x00 -#define RFC1002_SESSION_REQUEST 0x81 -#define RFC1002_POSITIVE_SESSION_RESPONSE 0x82 -#define RFC1002_NEGATIVE_SESSION_RESPONSE 0x83 -#define RFC1002_RETARGET_SESSION_RESPONSE 0x84 -#define RFC1002_SESSION_KEEP_ALIVE 0x85 - /* Responses when opening a file. */ #define F_SUPERSEDED 0 #define F_OPENED 1 From patchwork Tue Sep 21 12:41:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Namjae Jeon X-Patchwork-Id: 12507785 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1843C433FE for ; Tue, 21 Sep 2021 12:41:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8CF6860EE7 for ; Tue, 21 Sep 2021 12:41:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232815AbhIUMnW (ORCPT ); Tue, 21 Sep 2021 08:43:22 -0400 Received: from mail-pg1-f169.google.com ([209.85.215.169]:40677 "EHLO mail-pg1-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232895AbhIUMnU (ORCPT ); Tue, 21 Sep 2021 08:43:20 -0400 Received: by mail-pg1-f169.google.com with SMTP id h3so20579252pgb.7 for ; Tue, 21 Sep 2021 05:41:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=TscF5aL76QOIfd+LuFeUnYJd6cstd4+TrgvEpI/mcHk=; b=YT7+POJ5t8xzK+EsASqsHKVOENSq6XBTDbp1caqGQsvN4zMYPUoz0MKqLttvCHgMY+ TX5bnbHtb8eASx5ZuOz4KAFmM5NL/bYR5cAnMQbOKIQgax3tsdfkTnkieXg1kqxUTSfa m6ezKQLbgxVdW739A4P3cW1GNr9IG4yP2Z9IndG1zpERT/3uT/3gefON0pWXyR5Dx+xx Q28wsO9vNpUjjC7+O3vklwYWz5g9ERQbkUSU9TQxNLnnPj1VclBvcJ/l1rfO2TN51Sbl hCMs/wK3m/TL86luKdPda80j6NZBRYqbjruS+0e20icw7XMo+ZpcUW19bHtTzhutfE/R 91wg== X-Gm-Message-State: AOAM5309lxKJhYyumHTK2SXq+/LK5Wvxx7/OjEQpGh0jm7qGZJDAhs4Q ZUJnFohKBOfoE2SFgR8SXBJ73itL+BQYGA== X-Google-Smtp-Source: ABdhPJzVU9TMxyTSYPspjAUuSt9OWb7pHuR146MSXxWwYk3lyaj+qatQ+bGjrou1Z1G1p1g65ktpyA== X-Received: by 2002:a65:6084:: with SMTP id t4mr28067188pgu.25.1632228111424; Tue, 21 Sep 2021 05:41:51 -0700 (PDT) Received: from localhost.localdomain ([61.74.27.164]) by smtp.gmail.com with ESMTPSA id a11sm17248354pfo.31.2021.09.21.05.41.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Sep 2021 05:41:51 -0700 (PDT) From: Namjae Jeon To: linux-cifs@vger.kernel.org Cc: Namjae Jeon , Ronnie Sahlberg , =?utf-8?q?Ralph_B=C3=B6hme?= , Steve French Subject: [PATCH 2/3] ksmbd: add validation in smb2 negotiate Date: Tue, 21 Sep 2021 21:41:38 +0900 Message-Id: <20210921124139.18312-2-linkinjeon@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210921124139.18312-1-linkinjeon@kernel.org> References: <20210921124139.18312-1-linkinjeon@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org This patch add validation to check request buffer check in smb2 negotiate. Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Steve French Signed-off-by: Namjae Jeon --- fs/ksmbd/smb2pdu.c | 41 ++++++++++++++++++++++++++++++++++++++++- fs/ksmbd/smb_common.c | 22 ++++++++++++++++++++-- 2 files changed, 60 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index baf7ce31d557..1fe37ad4e5bc 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1071,7 +1071,7 @@ int smb2_handle_negotiate(struct ksmbd_work *work) struct ksmbd_conn *conn = work->conn; struct smb2_negotiate_req *req = work->request_buf; struct smb2_negotiate_rsp *rsp = work->response_buf; - int rc = 0; + int rc = 0, smb2_buf_len, smb2_neg_size; __le32 status; ksmbd_debug(SMB, "Received negotiate request\n"); @@ -1089,6 +1089,45 @@ int smb2_handle_negotiate(struct ksmbd_work *work) goto err_out; } + smb2_buf_len = get_rfc1002_len(work->request_buf); + smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects) - 4; + if (conn->dialect == SMB311_PROT_ID) { + int nego_ctxt_off = le32_to_cpu(req->NegotiateContextOffset); + int nego_ctxt_count = le16_to_cpu(req->NegotiateContextCount); + + if (smb2_buf_len < nego_ctxt_off + nego_ctxt_count) { + rsp->hdr.Status = STATUS_INVALID_PARAMETER; + rc = -EINVAL; + goto err_out; + } + + if (smb2_neg_size > nego_ctxt_off) { + rsp->hdr.Status = STATUS_INVALID_PARAMETER; + rc = -EINVAL; + goto err_out; + } + + if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > + nego_ctxt_off) { + rsp->hdr.Status = STATUS_INVALID_PARAMETER; + rc = -EINVAL; + goto err_out; + } + } else { + if (smb2_neg_size > smb2_buf_len) { + rsp->hdr.Status = STATUS_INVALID_PARAMETER; + rc = -EINVAL; + goto err_out; + } + + if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > + smb2_buf_len) { + rsp->hdr.Status = STATUS_INVALID_PARAMETER; + rc = -EINVAL; + goto err_out; + } + } + conn->cli_cap = le32_to_cpu(req->Capabilities); switch (conn->dialect) { case SMB311_PROT_ID: diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c index 1da67217698d..da17b21ac685 100644 --- a/fs/ksmbd/smb_common.c +++ b/fs/ksmbd/smb_common.c @@ -229,13 +229,22 @@ int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count) static int ksmbd_negotiate_smb_dialect(void *buf) { - __le32 proto; + int smb_buf_length = get_rfc1002_len(buf); + __le32 proto = ((struct smb2_hdr *)buf)->ProtocolId; - proto = ((struct smb2_hdr *)buf)->ProtocolId; if (proto == SMB2_PROTO_NUMBER) { struct smb2_negotiate_req *req; + int smb2_neg_size = + offsetof(struct smb2_negotiate_req, Dialects) - 4; req = (struct smb2_negotiate_req *)buf; + if (smb2_neg_size > smb_buf_length) + goto err_out; + + if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > + smb_buf_length) + goto err_out; + return ksmbd_lookup_dialect_by_id(req->Dialects, req->DialectCount); } @@ -245,10 +254,19 @@ static int ksmbd_negotiate_smb_dialect(void *buf) struct smb_negotiate_req *req; req = (struct smb_negotiate_req *)buf; + if (le16_to_cpu(req->ByteCount) < 2) + goto err_out; + + if (offsetof(struct smb_negotiate_req, DialectsArray) - 4 + + le16_to_cpu(req->ByteCount) > smb_buf_length) { + goto err_out; + } + return ksmbd_lookup_dialect_by_name(req->DialectsArray, req->ByteCount); } +err_out: return BAD_PROT_ID; } From patchwork Tue Sep 21 12:41:39 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Namjae Jeon X-Patchwork-Id: 12507787 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47C4DC433EF for ; Tue, 21 Sep 2021 12:41:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 278F760EE7 for ; Tue, 21 Sep 2021 12:41:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232827AbhIUMnX (ORCPT ); Tue, 21 Sep 2021 08:43:23 -0400 Received: from mail-pg1-f173.google.com ([209.85.215.173]:46048 "EHLO mail-pg1-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232784AbhIUMnX (ORCPT ); Tue, 21 Sep 2021 08:43:23 -0400 Received: by mail-pg1-f173.google.com with SMTP id n18so20570712pgm.12 for ; Tue, 21 Sep 2021 05:41:54 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=2rPUyUebApkMdqLU1MJzy+93KaJ00Vx6WyrA/wf5aPE=; b=IuSqCdhynYsnPV3JTlzDJiZjtB/YbRSU+6KacnyEyWgFwKr9qLVU4KSWHiQMfpORkx C1DE+PCQsXhX7jk2rJFZLnPaMEWG6UZMYDUolmF73cfkmawipNZi2b/Yb51evrRMveVG jXak993cgUZV5lyO0fSHC7xWhNKMG6tDrrARINpMELUbsdboOUE5cVzcFdT6PLx1YQvj KNsnrXSOAK/6j6l/wjyejcUGw3XhJJklvmi4fkBwYLjVLDfre/yvNF/Gw9sQqgEWdhBO qIzyi7/kLtFwTG2tPGraRPSaPF5VX6cn+wHbJ9OjMZ0WGSMfzPNUjt5aLNkWLmelvj9u eMFg== X-Gm-Message-State: AOAM533aP3KbR7feDsd/qfGJo+ZAcKClgC+YjhY7oe/eo2HaWxLaRK2t kQ+ckTQMnokeiFMSIvV8TnUFqUmc/4Ib6w== X-Google-Smtp-Source: ABdhPJwfnKynKhRMXYeJNEOOiAghif8mFXygRjG1u0PXbUYinR5wtjZrOgBAy0spfnpLQIDd28M7Og== X-Received: by 2002:a65:624b:: with SMTP id q11mr27872899pgv.232.1632228114473; Tue, 21 Sep 2021 05:41:54 -0700 (PDT) Received: from localhost.localdomain ([61.74.27.164]) by smtp.gmail.com with ESMTPSA id a11sm17248354pfo.31.2021.09.21.05.41.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Sep 2021 05:41:54 -0700 (PDT) From: Namjae Jeon To: linux-cifs@vger.kernel.org Cc: Namjae Jeon , Ronnie Sahlberg , =?utf-8?q?Ralph_B=C3=B6hme?= , Steve French , Ronnie Sahlberg Subject: [PATCH 3/3] ksmbd: fix invalid request buffer access in compound request Date: Tue, 21 Sep 2021 21:41:39 +0900 Message-Id: <20210921124139.18312-3-linkinjeon@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210921124139.18312-1-linkinjeon@kernel.org> References: <20210921124139.18312-1-linkinjeon@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org Ronnie reported invalid request buffer access in chained command when inserting garbage value to NextCommand of compound request. This patch add validation check to avoid this issue. Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Steve French Reported-by: Ronnie Sahlberg Signed-off-by: Namjae Jeon --- fs/ksmbd/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 1fe37ad4e5bc..cae796ea1148 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -466,6 +466,13 @@ bool is_chained_smb2_message(struct ksmbd_work *work) hdr = ksmbd_req_buf_next(work); if (le32_to_cpu(hdr->NextCommand) > 0) { + if (work->next_smb2_rcv_hdr_off + le32_to_cpu(hdr->NextCommand) > + get_rfc1002_len(work->request_buf)) { + pr_err("next command(%u) offset exceeds smb msg size\n", + hdr->NextCommand); + return false; + } + ksmbd_debug(SMB, "got SMB2 chained command\n"); init_chained_smb2_rsp(work); return true;