[2/2] SMB: fix validate negotiate info uninitialised memory use

Message ID 20171020124938.9913-3-ddiss@suse.de
State New
Headers show
Series
  • SMB: fix memory leak in smb3_validate_negotiate
Related show

Commit Message

David Disseldorp Oct. 20, 2017, 12:49 p.m.
An undersize validate negotiate info server response causes the client
to use uninitialised memory for struct validate_negotiate_info_rsp
comparisons of Dialect, SecurityMode and/or Capabilities members.

Link: https://bugzilla.samba.org/show_bug.cgi?id=13092
Fixes: 7db0a6efdc3e ("SMB3: Work around mount failure when using SMB3 dialect to Macs")
Signed-off-by: David Disseldorp <ddiss@suse.de>
---
 fs/cifs/smb2pdu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Pavel Shilovsky Oct. 25, 2017, 6:04 p.m. | #1
Looks good.

Acked-by: Pavel Shilovsky <pshilov@microsoft.com>


Best regards,
Pavel Shilovskiy


2017-10-20 5:49 GMT-07:00 David Disseldorp via samba-technical
<samba-technical@lists.samba.org>:
> An undersize validate negotiate info server response causes the client
> to use uninitialised memory for struct validate_negotiate_info_rsp
> comparisons of Dialect, SecurityMode and/or Capabilities members.
>
> Link: https://bugzilla.samba.org/show_bug.cgi?id=13092
> Fixes: 7db0a6efdc3e ("SMB3: Work around mount failure when using SMB3 dialect to Macs")
> Signed-off-by: David Disseldorp <ddiss@suse.de>
> ---
>  fs/cifs/smb2pdu.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
> index 052ab5dee6b6..c836de2f79b2 100644
> --- a/fs/cifs/smb2pdu.c
> +++ b/fs/cifs/smb2pdu.c
> @@ -727,7 +727,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
>                          rsplen);
>
>                 /* relax check since Mac returns max bufsize allowed on ioctl */
> -               if (rsplen > CIFSMaxBufSize)
> +               if ((rsplen > CIFSMaxBufSize)
> +                    || (rsplen < sizeof(struct validate_negotiate_info_rsp)))
>                         goto err_rsp_free;
>         }
>
> --
> 2.13.6
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 052ab5dee6b6..c836de2f79b2 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -727,7 +727,8 @@  int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
 			 rsplen);
 
 		/* relax check since Mac returns max bufsize allowed on ioctl */
-		if (rsplen > CIFSMaxBufSize)
+		if ((rsplen > CIFSMaxBufSize)
+		     || (rsplen < sizeof(struct validate_negotiate_info_rsp)))
 			goto err_rsp_free;
 	}