moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ksmbd: limit pdu length size according to connection status

Browse Source 
commit 62c487b53a7ff31e322cf2874d3796b8202c54a5 upstream.

Stream protocol length will never be larger than 16KB until session setup.
After session setup, the size of requests will not be larger than
16KB + SMB2 MAX WRITE size. This patch limits these invalidly oversized
requests and closes the connection immediately.

Fixes: 0626e6641f ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Namjae Jeon
2023-01-25 00:13:20 +09:00
committed by Greg Kroah-Hartman
parent 8d83a758ee
commit 33a9657d67
2 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
fs/ksmbd/connection.c
View File

@@ -274,7 +274,7 @@ int ksmbd_conn_handler_loop(void *p)
{ {
struct ksmbd_conn *conn = (struct ksmbd_conn *)p; struct ksmbd_conn *conn = (struct ksmbd_conn *)p;
struct ksmbd_transport *t = conn->transport; struct ksmbd_transport *t = conn->transport;
unsigned int pdu_size; unsigned int pdu_size, max_allowed_pdu_size;
char hdr_buf[4] = {0,}; char hdr_buf[4] = {0,};
int size; int size;
@@ -299,13 +299,26 @@ int ksmbd_conn_handler_loop(void *p)
pdu_size = get_rfc1002_len(hdr_buf); pdu_size = get_rfc1002_len(hdr_buf);
ksmbd_debug(CONN, "RFC1002 header %u bytes\n", pdu_size); ksmbd_debug(CONN, "RFC1002 header %u bytes\n", pdu_size);
if (conn->status == KSMBD_SESS_GOOD)
max_allowed_pdu_size =
SMB3_MAX_MSGSIZE + conn->vals->max_write_size;
else
max_allowed_pdu_size = SMB3_MAX_MSGSIZE;
if (pdu_size > max_allowed_pdu_size) {
pr_err_ratelimited("PDU length(%u) excceed maximum allowed pdu size(%u) on connection(%d)\n",
pdu_size, max_allowed_pdu_size,
conn->status);
break;
}
/* /*
* Check if pdu size is valid (min : smb header size, * Check if pdu size is valid (min : smb header size,
* max : 0x00FFFFFF). * max : 0x00FFFFFF).
*/ */
if (pdu_size < __SMB2_HEADER_STRUCTURE_SIZE || if (pdu_size < __SMB2_HEADER_STRUCTURE_SIZE ||
pdu_size > MAX_STREAM_PROT_LEN) { pdu_size > MAX_STREAM_PROT_LEN) {
continue; break;
} }
/* 4 for rfc1002 length field */ /* 4 for rfc1002 length field */

5
fs/ksmbd/smb2pdu.h
View File

@@ -113,8 +113,9 @@
#define SMB21_DEFAULT_IOSIZE (1024 * 1024) #define SMB21_DEFAULT_IOSIZE (1024 * 1024)
#define SMB3_DEFAULT_IOSIZE (4 * 1024 * 1024) #define SMB3_DEFAULT_IOSIZE (4 * 1024 * 1024)
#define SMB3_DEFAULT_TRANS_SIZE (1024 * 1024) #define SMB3_DEFAULT_TRANS_SIZE (1024 * 1024)
#define SMB3_MIN_IOSIZE (64 * 1024) #define SMB3_MIN_IOSIZE (64 * 1024)
#define SMB3_MAX_IOSIZE (8 * 1024 * 1024) #define SMB3_MAX_IOSIZE (8 * 1024 * 1024)
#define SMB3_MAX_MSGSIZE (4 * 4096)
/* /*
* SMB2 Header Definition * SMB2 Header Definition