• Paulo Alcantara's avatar
    smb: client: fix OOB in smbCalcSize() · b35858b3
    Paulo Alcantara authored
    Validate @smb->WordCount to avoid reading off the end of @smb and thus
    causing the following KASAN splat:
    
      BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs]
      Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328
    
      CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
      rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
      Call Trace:
       <TASK>
       dump_stack_lvl+0x4a/0x80
       print_report+0xcf/0x650
       ? srso_alias_return_thunk+0x5/0xfbef5
       ? srso_alias_return_thunk+0x5/0xfbef5
       ? __phys_addr+0x46/0x90
       kasan_report+0xd8/0x110
       ? smbCalcSize+0x32/0x40 [cifs]
       ? smbCalcSize+0x32/0x40 [cifs]
       kasan_check_range+0x105/0x1b0
       smbCalcSize+0x32/0x40 [cifs]
       checkSMB+0x162/0x370 [cifs]
       ? __pfx_checkSMB+0x10/0x10 [cifs]
       cifs_handle_standard+0xbc/0x2f0 [cifs]
       ? srso_alias_return_thunk+0x5/0xfbef5
       cifs_demultiplex_thread+0xed1/0x1360 [cifs]
       ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
       ? srso_alias_return_thunk+0x5/0xfbef5
       ? lockdep_hardirqs_on_prepare+0x136/0x210
       ? __pfx_lock_release+0x10/0x10
       ? srso_alias_return_thunk+0x5/0xfbef5
       ? mark_held_locks+0x1a/0x90
       ? lockdep_hardirqs_on_prepare+0x136/0x210
       ? srso_alias_return_thunk+0x5/0xfbef5
       ? srso_alias_return_thunk+0x5/0xfbef5
       ? __kthread_parkme+0xce/0xf0
       ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
       kthread+0x18d/0x1d0
       ? kthread+0xdb/0x1d0
       ? __pfx_kthread+0x10/0x10
       ret_from_fork+0x34/0x60
       ? __pfx_kthread+0x10/0x10
       ret_from_fork_asm+0x1b/0x30
       </TASK>
    
    This fixes CVE-2023-6606.
    
    Reported-by: j51569436@gmail.com
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarPaulo Alcantara (SUSE) <pc@manguebit.com>
    Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
    b35858b3
misc.c 35.8 KB