Attachment 27397 Details for Bug 61204

[patch] smbfs-security-fix

smbfs-security-fix (text/plain), 4.66 KB, created by Marcus Meissner on 2005-01-05 18:30:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2005-01-05 18:30:09 UTC

Size: 4.66 KB

patch

obsolete

>From: Urban Widmark
>Subject: Security fix for 2.6 smbfs
>References: 46204
>
>This patch fixes a kernel memory exposure in the smbfs client that
>can be triggered through CIFS fragment rebuilding.
>
>
>Index: linux-2.6.8/fs/smbfs/proc.c
>===================================================================
>--- linux-2.6.8.orig/fs/smbfs/proc.c	2004-11-10 12:26:17.000000000 +0100
>+++ linux-2.6.8/fs/smbfs/proc.c	2004-11-10 12:27:58.000000000 +0100
>@@ -1428,9 +1428,9 @@ smb_proc_readX_data(struct smb_request *
> 	 * So we must first calculate the amount of padding used by the server.
> 	 */
> 	data_off -= hdrlen;
>-	if (data_off > SMB_READX_MAX_PAD) {
>-		PARANOIA("offset is larger than max pad!\n");
>-		PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
>+	if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
>+		PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
>+		PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
> 		req->rq_rlen = req->rq_bufsize + 1;
> 		return;
> 	}
>Index: linux-2.6.8/fs/smbfs/request.c
>===================================================================
>--- linux-2.6.8.orig/fs/smbfs/request.c	2004-11-10 12:26:17.000000000 +0100
>+++ linux-2.6.8/fs/smbfs/request.c	2004-11-10 12:27:58.000000000 +0100
>@@ -588,8 +588,5 @@
> 	data_count  = WVAL(inbuf, smb_drcnt);
> 
>-	/* Modify offset for the split header/buffer we use */
>-	data_offset -= hdrlen;
>-	parm_offset -= hdrlen;
> 
> 	if (parm_count == parm_tot && data_count == data_tot) {
> 		/*
>@@ -599,17 +597,52 @@
> 		 * case. It may be a server error to not return a
> 		 * response that fits.
> 		 */
>+		/* _count = 0 is a special case, where data_offset is
>+		 * not used.
>+		 */
>+		if (data_count != 0) {
>+			if (data_offset < hdrlen)
>+				goto out_bad_data;
>+			/* Modify offset for the split header/buffer we use */
>+			data_offset -= hdrlen;
>+			if (data_offset + data_count > req->rq_rlen)
>+				goto out_bad_data;
>+			req->rq_ldata = data_count;
>+			req->rq_data = req->rq_buffer + data_offset;
>+		} else {
>+			req->rq_data  = NULL;
>+			req->rq_ldata = 0;
>+		}
>+
>+		if (parm_count != 0) {
>+			if (parm_offset < hdrlen)
>+				goto out_bad_parm;
>+			/* Modify offset for the split header/buffer we use */
>+			parm_offset  -= hdrlen;
>+			if (parm_offset + parm_count > req->rq_rlen)
>+				goto out_bad_parm;
>+			req->rq_lparm = parm_count;
>+			req->rq_parm  = req->rq_buffer + parm_offset;
>+		} else {
>+			req->rq_lparm = 0;
>+			req->rq_parm  = NULL;
>+		}
>+
> 		VERBOSE("single trans2 response  "
> 			"dcnt=%d, pcnt=%d, doff=%d, poff=%d\n",
> 			data_count, parm_count,
> 			data_offset, parm_offset);
>-		req->rq_ldata = data_count;
>-		req->rq_lparm = parm_count;
>-		req->rq_data = req->rq_buffer + data_offset;
>-		req->rq_parm = req->rq_buffer + parm_offset;
> 		return 0;
> 	}
> 
>+	if (data_offset < hdrlen)
>+		goto out_bad_data;
>+	if (parm_offset < hdrlen)
>+		goto out_bad_parm;
>+	parm_offset -= hdrlen;
>+	data_offset -= hdrlen;
>+
>+
> 	VERBOSE("multi trans2 response  "
> 		"frag=%d, dcnt=%d, pcnt=%d, doff=%d, poff=%d\n",
> 		req->rq_fragment,
>@@ -634,6 +665,7 @@
> 		req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS);
> 		if (!req->rq_trans2buffer)
> 			goto out_no_mem;
>+		memset(req->rq_trans2buffer, 0, buf_len);
> 
> 		req->rq_parm = req->rq_trans2buffer;
> 		req->rq_data = req->rq_trans2buffer + parm_tot;
>@@ -643,8 +675,12 @@
> 
> 	if (parm_disp + parm_count > req->rq_total_parm)
> 		goto out_bad_parm;
>+	if (parm_offset + parm_count > req->rq_rlen)
>+		goto out_bad_parm;
> 	if (data_disp + data_count > req->rq_total_data)
> 		goto out_bad_data;
>+	if (data_offset + data_count > req->rq_rlen)
>+		goto out_bad_data;
> 
> 	inbuf = req->rq_buffer;
> 	memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
>@@ -657,8 +693,11 @@
> 	 * Check whether we've received all of the data. Note that
> 	 * we use the packet totals -- total lengths might shrink!
> 	 */
>-	if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot)
>+	if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
>+		req->rq_ldata = data_tot;
>+		req->rq_lparm = parm_tot;
> 		return 0;
>+	}
> 	return 1;
> 
> out_too_long:
>@@ -676,13 +715,13 @@
> 	req->rq_errno = -EIO;
> 	goto out;
> out_bad_parm:
>-	printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
>-	       parm_disp, parm_count, parm_tot);
>+	printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
>+	       parm_disp, parm_count, parm_tot, parm_offset);
> 	req->rq_errno = -EIO;
> 	goto out;
> out_bad_data:
>-	printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
>-	       data_disp, data_count, data_tot);
>+	printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
>+	       data_disp, data_count, data_tot, data_offset);
> 	req->rq_errno = -EIO;
> out:
> 	return req->rq_errno;

Actions: View | Diff

Attachments on bug 61204: 24025 | 24687 | 25202 | 25459 | 25460 | 27379 | 27397 | 27398 | 27616 | 27619