| Message ID | 20190627045702.8701-1-lsahlber@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | cifs: fix crash for querying symlinks stored as reparse-points | expand |
removed the duplicate definition of IO_REPARSE_TAG_SYMLINK and tentatively merged to cifs-2.6.git for-next but looks good so far in testing. On Wed, Jun 26, 2019 at 11:57 PM Ronnie Sahlberg <lsahlber@redhat.com> wrote: > > We never parsed/returned any data from .get_link() when the object is a windows reparse-point > containing a symlink. This results in the VFS layer oopsing accessing an uninitialized buffer: > > ... > [ 171.407172] Call Trace: > [ 171.408039] readlink_copy+0x29/0x70 > [ 171.408872] vfs_readlink+0xc1/0x1f0 > [ 171.409709] ? readlink_copy+0x70/0x70 > [ 171.410565] ? simple_attr_release+0x30/0x30 > [ 171.411446] ? getname_flags+0x105/0x2a0 > [ 171.412231] do_readlinkat+0x1b7/0x1e0 > [ 171.412938] ? __ia32_compat_sys_newfstat+0x30/0x30 > ... > > Fix this by adding code to handle these buffers and make sure we do return a valid buffer > to .get_link() > > CC: Stable <stable@vger.kernel.org> > Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com> > --- > fs/cifs/smb2ops.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++---- > fs/cifs/smb2pdu.h | 16 +++++++++++++- > 2 files changed, 75 insertions(+), 5 deletions(-) > > diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c > index e921e6511728..74c826007069 100644 > --- a/fs/cifs/smb2ops.c > +++ b/fs/cifs/smb2ops.c > @@ -2385,6 +2385,41 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses, > kfree(dfs_rsp); > return rc; > } > + > +static int > +parse_reparse_symlink(struct reparse_symlink_data_buffer *symlink_buf, > + u32 plen, char **target_path, > + struct cifs_sb_info *cifs_sb) > +{ > + unsigned int sub_len; > + unsigned int sub_offset; > + > + /* We only handle Symbolic Link : MS-FSCC 2.1.2.4 */ > + if (le32_to_cpu(symlink_buf->ReparseTag) != REPARSE_TAG_SYMLINK) { > + cifs_dbg(VFS, "srv returned invalid symlink buffer\n"); > + return -EIO; > + } > + > + sub_offset = le16_to_cpu(symlink_buf->SubstituteNameOffset); > + sub_len = le16_to_cpu(symlink_buf->SubstituteNameLength); > + if (sub_offset + 20 > plen || > + sub_offset + sub_len + 20 > plen) { > + cifs_dbg(VFS, "srv returned malformed symlink buffer\n"); > + return -EIO; > + } > + > + *target_path = cifs_strndup_from_utf16( > + symlink_buf->PathBuffer + sub_offset, > + sub_len, true, cifs_sb->local_nls); > + if (!(*target_path)) > + return -ENOMEM; > + > + convert_delimiter(*target_path, '/'); > + cifs_dbg(FYI, "%s: target path: %s\n", __func__, *target_path); > + > + return 0; > +} > + > #define SMB2_SYMLINK_STRUCT_SIZE \ > (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) > > @@ -2414,11 +2449,13 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, > struct kvec close_iov[1]; > struct smb2_create_rsp *create_rsp; > struct smb2_ioctl_rsp *ioctl_rsp; > - char *ioctl_buf; > + struct reparse_data_buffer *reparse_buf; > u32 plen; > > cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path); > > + *target_path = NULL; > + > if (smb3_encryption_required(tcon)) > flags |= CIFS_TRANSFORM_REQ; > > @@ -2496,17 +2533,36 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, > if ((rc == 0) && (is_reparse_point)) { > /* See MS-FSCC 2.3.23 */ > > - ioctl_buf = (char *)ioctl_rsp + le32_to_cpu(ioctl_rsp->OutputOffset); > + reparse_buf = (struct reparse_data_buffer *) > + ((char *)ioctl_rsp + > + le32_to_cpu(ioctl_rsp->OutputOffset)); > plen = le32_to_cpu(ioctl_rsp->OutputCount); > > if (plen + le32_to_cpu(ioctl_rsp->OutputOffset) > > rsp_iov[1].iov_len) { > - cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", plen); > + cifs_dbg(VFS, "srv returned invalid ioctl len: %d\n", > + plen); > + rc = -EIO; > + goto querty_exit; > + } > + > + if (plen < 8) { > + cifs_dbg(VFS, "reparse buffer is too small. Must be " > + "at least 8 bytes but was %d\n", plen); > + rc = -EIO; > + goto querty_exit; > + } > + > + if (plen < le16_to_cpu(reparse_buf->ReparseDataLength) + 8) { > + cifs_dbg(VFS, "srv returned invalid reparse buf " > + "length: %d\n", plen); > rc = -EIO; > goto querty_exit; > } > > - /* Do stuff with ioctl_buf/plen */ > + rc = parse_reparse_symlink( > + (struct reparse_symlink_data_buffer *)reparse_buf, > + plen, target_path, cifs_sb); > goto querty_exit; > } > > diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h > index c7d5813bebd8..31f7c56e0ed8 100644 > --- a/fs/cifs/smb2pdu.h > +++ b/fs/cifs/smb2pdu.h > @@ -888,6 +888,8 @@ struct file_allocated_range_buffer { > > /* struct fsctl_reparse_info_req is empty, only response structs (see below) */ > > +#define REPARSE_TAG_SYMLINK 0xa000000c > + > struct reparse_data_buffer { > __le32 ReparseTag; > __le16 ReparseDataLength; > @@ -914,7 +916,19 @@ struct reparse_mount_point_data_buffer { > __u8 PathBuffer[0]; /* Variable Length */ > } __packed; > > -/* See MS-FSCC 2.1.2.4 and cifspdu.h for struct reparse_symlink_data */ > +#define SYMLINK_FLAG_RELATIVE 0x00000001 > + > +struct reparse_symlink_data_buffer { > + __le32 ReparseTag; > + __le16 ReparseDataLength; > + __u16 Reserved; > + __le16 SubstituteNameOffset; > + __le16 SubstituteNameLength; > + __le16 PrintNameOffset; > + __le16 PrintNameLength; > + __le32 Flags; > + __u8 PathBuffer[0]; /* Variable Length */ > +} __packed; > > /* See MS-FSCC 2.1.2.6 and cifspdu.h for struct reparse_posix_data */ > > -- > 2.13.6 >
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index e921e6511728..74c826007069 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -2385,6 +2385,41 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses, kfree(dfs_rsp); return rc; } + +static int +parse_reparse_symlink(struct reparse_symlink_data_buffer *symlink_buf, + u32 plen, char **target_path, + struct cifs_sb_info *cifs_sb) +{ + unsigned int sub_len; + unsigned int sub_offset; + + /* We only handle Symbolic Link : MS-FSCC 2.1.2.4 */ + if (le32_to_cpu(symlink_buf->ReparseTag) != REPARSE_TAG_SYMLINK) { + cifs_dbg(VFS, "srv returned invalid symlink buffer\n"); + return -EIO; + } + + sub_offset = le16_to_cpu(symlink_buf->SubstituteNameOffset); + sub_len = le16_to_cpu(symlink_buf->SubstituteNameLength); + if (sub_offset + 20 > plen || + sub_offset + sub_len + 20 > plen) { + cifs_dbg(VFS, "srv returned malformed symlink buffer\n"); + return -EIO; + } + + *target_path = cifs_strndup_from_utf16( + symlink_buf->PathBuffer + sub_offset, + sub_len, true, cifs_sb->local_nls); + if (!(*target_path)) + return -ENOMEM; + + convert_delimiter(*target_path, '/'); + cifs_dbg(FYI, "%s: target path: %s\n", __func__, *target_path); + + return 0; +} + #define SMB2_SYMLINK_STRUCT_SIZE \ (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) @@ -2414,11 +2449,13 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, struct kvec close_iov[1]; struct smb2_create_rsp *create_rsp; struct smb2_ioctl_rsp *ioctl_rsp; - char *ioctl_buf; + struct reparse_data_buffer *reparse_buf; u32 plen; cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path); + *target_path = NULL; + if (smb3_encryption_required(tcon)) flags |= CIFS_TRANSFORM_REQ; @@ -2496,17 +2533,36 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, if ((rc == 0) && (is_reparse_point)) { /* See MS-FSCC 2.3.23 */ - ioctl_buf = (char *)ioctl_rsp + le32_to_cpu(ioctl_rsp->OutputOffset); + reparse_buf = (struct reparse_data_buffer *) + ((char *)ioctl_rsp + + le32_to_cpu(ioctl_rsp->OutputOffset)); plen = le32_to_cpu(ioctl_rsp->OutputCount); if (plen + le32_to_cpu(ioctl_rsp->OutputOffset) > rsp_iov[1].iov_len) { - cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", plen); + cifs_dbg(VFS, "srv returned invalid ioctl len: %d\n", + plen); + rc = -EIO; + goto querty_exit; + } + + if (plen < 8) { + cifs_dbg(VFS, "reparse buffer is too small. Must be " + "at least 8 bytes but was %d\n", plen); + rc = -EIO; + goto querty_exit; + } + + if (plen < le16_to_cpu(reparse_buf->ReparseDataLength) + 8) { + cifs_dbg(VFS, "srv returned invalid reparse buf " + "length: %d\n", plen); rc = -EIO; goto querty_exit; } - /* Do stuff with ioctl_buf/plen */ + rc = parse_reparse_symlink( + (struct reparse_symlink_data_buffer *)reparse_buf, + plen, target_path, cifs_sb); goto querty_exit; } diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h index c7d5813bebd8..31f7c56e0ed8 100644 --- a/fs/cifs/smb2pdu.h +++ b/fs/cifs/smb2pdu.h @@ -888,6 +888,8 @@ struct file_allocated_range_buffer { /* struct fsctl_reparse_info_req is empty, only response structs (see below) */ +#define REPARSE_TAG_SYMLINK 0xa000000c + struct reparse_data_buffer { __le32 ReparseTag; __le16 ReparseDataLength; @@ -914,7 +916,19 @@ struct reparse_mount_point_data_buffer { __u8 PathBuffer[0]; /* Variable Length */ } __packed; -/* See MS-FSCC 2.1.2.4 and cifspdu.h for struct reparse_symlink_data */ +#define SYMLINK_FLAG_RELATIVE 0x00000001 + +struct reparse_symlink_data_buffer { + __le32 ReparseTag; + __le16 ReparseDataLength; + __u16 Reserved; + __le16 SubstituteNameOffset; + __le16 SubstituteNameLength; + __le16 PrintNameOffset; + __le16 PrintNameLength; + __le32 Flags; + __u8 PathBuffer[0]; /* Variable Length */ +} __packed; /* See MS-FSCC 2.1.2.6 and cifspdu.h for struct reparse_posix_data */
We never parsed/returned any data from .get_link() when the object is a windows reparse-point containing a symlink. This results in the VFS layer oopsing accessing an uninitialized buffer: ... [ 171.407172] Call Trace: [ 171.408039] readlink_copy+0x29/0x70 [ 171.408872] vfs_readlink+0xc1/0x1f0 [ 171.409709] ? readlink_copy+0x70/0x70 [ 171.410565] ? simple_attr_release+0x30/0x30 [ 171.411446] ? getname_flags+0x105/0x2a0 [ 171.412231] do_readlinkat+0x1b7/0x1e0 [ 171.412938] ? __ia32_compat_sys_newfstat+0x30/0x30 ... Fix this by adding code to handle these buffers and make sure we do return a valid buffer to .get_link() CC: Stable <stable@vger.kernel.org> Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com> --- fs/cifs/smb2ops.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++---- fs/cifs/smb2pdu.h | 16 +++++++++++++- 2 files changed, 75 insertions(+), 5 deletions(-)