[PATCH OLK-5.10 0/2] Fix CVE-2026-98454
Fix CVE-2026-98454 Steve French (1): smb3: make query_on_disk_id open context consistent and move to common code Zihan Xi (1): smb: client: fix create context out-of-bounds reads fs/cifs/smb2ops.c | 28 ++++++++++++++++++++-------- fs/cifs/smb2pdu.c | 44 ++++++++++++++++++++++++++++++++++---------- fs/cifs/smb2pdu.h | 6 +++--- 3 files changed, 57 insertions(+), 21 deletions(-) -- 2.52.0
From: Steve French <stfrench@microsoft.com> maillist inclusion category: cleanup bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20387 Reference: https://lore.kernel.org/all/20260930174901.3771743-1-sashal@kernel.org/ -------------------------------- [ Upstream commit 1149c8467ddebfb6bb9aab37830f70a49cab7085 ] cifs and ksmbd were using a slightly different version of the query_on_disk_id struct which could be confusing. Use the ksmbd version of this struct, and move it to common code. Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com> Signed-off-by: Steve French <stfrench@microsoft.com> [5.15 dependency adaptation for 67f4c1c6a1b: Keep the create-context declarations in the existing per-subsystem headers. This tree has not consolidated create_context into smbfs_common, and ksmbd still defines its own SMB2 headers. Moving the response into the common header would require unrelated header conversions. Retain the client response rename and match ksmbd's 16-byte Reserved array, without changing the packed wire layout. Leave the ksmbd and common headers unchanged and omit the upstream common-header lease comments. Rename the client's lease-break flag and both existing parser uses to the upstream _LE spelling. This is a value-preserving prerequisite for the target's lease-parser changes; no functions are added.] [ sashal: Reduced backport -- upstream 1149c8467ddeb touches 4 file(s), this backport carries 3. Not backported here: fs/ksmbd/smb2pdu.h fs/smbfs_common/smb2pdu.h This note is generated from the file lists only; see the resolution record for the reasoning. ] Stable-dep-of: 67f4c1c6a1b5 ("smb: client: fix create context out-of-bounds reads") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/cifs/smb2ops.c | 4 ++-- fs/cifs/smb2pdu.c | 2 +- fs/cifs/smb2pdu.h | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index dd72160a4bb4..5f7e25639b41 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -4168,22 +4168,22 @@ static __u8 smb2_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key) { struct create_lease *lc = (struct create_lease *)buf; *epoch = 0; /* not used */ - if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS) + if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE) return SMB2_OPLOCK_LEVEL_NOCHANGE; return le32_to_cpu(lc->lcontext.LeaseState); } static __u8 smb3_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key) { struct create_lease_v2 *lc = (struct create_lease_v2 *)buf; *epoch = le16_to_cpu(lc->lcontext.Epoch); - if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS) + if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE) return SMB2_OPLOCK_LEVEL_NOCHANGE; if (lease_key) memcpy(lease_key, &lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE); return le32_to_cpu(lc->lcontext.LeaseState); } diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index c20a6e7c8b5c..29ec57680788 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -1955,11 +1955,11 @@ create_reconnect_durable_buf(struct cifs_fid *fid) } static void parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) { - struct create_on_disk_id *pdisk_id = (struct create_on_disk_id *)cc; + struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", pdisk_id->DiskFileId, pdisk_id->VolumeId); buf->IndexNumber = pdisk_id->DiskFileId; } diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h index eaa873175318..a24341d92bf2 100644 --- a/fs/cifs/smb2pdu.h +++ b/fs/cifs/smb2pdu.h @@ -848,11 +848,11 @@ struct create_context { #define SMB2_LEASE_NONE cpu_to_le32(0x00) #define SMB2_LEASE_READ_CACHING cpu_to_le32(0x01) #define SMB2_LEASE_HANDLE_CACHING cpu_to_le32(0x02) #define SMB2_LEASE_WRITE_CACHING cpu_to_le32(0x04) -#define SMB2_LEASE_FLAG_BREAK_IN_PROGRESS cpu_to_le32(0x00000002) +#define SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE cpu_to_le32(0x00000002) #define SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET cpu_to_le32(0x00000004) #define SMB2_LEASE_KEY_SIZE 16 struct lease_context { @@ -930,16 +930,16 @@ struct durable_reconnect_context_v2 { __u8 CreateGuid[16]; __le32 Flags; /* see above DHANDLE_FLAG_PERSISTENT */ } __packed; /* See MS-SMB2 2.2.14.2.9 */ -struct create_on_disk_id { +struct create_disk_id_rsp { struct create_context ccontext; __u8 Name[8]; __le64 DiskFileId; __le64 VolumeId; - __u32 Reserved[4]; + __u8 Reserved[16]; } __packed; /* See MS-SMB2 2.2.14.2.12 */ struct durable_reconnect_context_v2_rsp { __le32 Timeout; -- 2.52.0
From: Zihan Xi <zihanx@nebusec.ai> maillist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20387 Reference: https://lore.kernel.org/all/20260930174901.3771743-2-sashal@kernel.org/ -------------------------------- [ Upstream commit 67f4c1c6a1b51e203d986779299824d1c2c590a6 ] smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength was still accepted. Limit each context to its Next value, reject offsets before the context header, and reject malformed chains. Bound the name range by the current context and do not dispatch a known handler when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open. Fixes: b8c32dbb0deb ("CIFS: Request SMB2.1 leases") Fixes: f047390a097e ("CIFS: Add create lease v2 context for SMB3") Fixes: 89a5bfa350fa ("smb3: optimize open to not send query file internal info") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Assisted-by: LLM Co-developed-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Zihan Xi <zihanx@nebusec.ai> Tested-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/cifs/smb2ops.c | 28 ++++++++++++++++++++-------- fs/cifs/smb2pdu.c | 44 ++++++++++++++++++++++++++++++++++---------- 2 files changed, 54 insertions(+), 18 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 5f7e25639b41..3db3c32d6d16 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -4165,29 +4165,41 @@ smb3_create_lease_buf(u8 *lease_key, u8 oplock) } static __u8 smb2_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key) { - struct create_lease *lc = (struct create_lease *)buf; + struct create_context *cc = buf; + struct lease_context lc; *epoch = 0; /* not used */ - if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE) + if (le32_to_cpu(cc->DataLength) != sizeof(lc)) + return 0; + + memcpy(&lc, (u8 *)cc + le16_to_cpu(cc->DataOffset), sizeof(lc)); + if (lc.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE) return SMB2_OPLOCK_LEVEL_NOCHANGE; - return le32_to_cpu(lc->lcontext.LeaseState); + return le32_to_cpu(lc.LeaseState); } static __u8 smb3_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key) { - struct create_lease_v2 *lc = (struct create_lease_v2 *)buf; + struct create_context *cc = buf; + struct lease_context_v2 lc; + + if (le32_to_cpu(cc->DataLength) != sizeof(lc)) { + *epoch = 0; + return 0; + } - *epoch = le16_to_cpu(lc->lcontext.Epoch); - if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE) + memcpy(&lc, (u8 *)cc + le16_to_cpu(cc->DataOffset), sizeof(lc)); + *epoch = le16_to_cpu(lc.Epoch); + if (lc.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE) return SMB2_OPLOCK_LEVEL_NOCHANGE; if (lease_key) - memcpy(lease_key, &lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE); - return le32_to_cpu(lc->lcontext.LeaseState); + memcpy(lease_key, lc.LeaseKey, SMB2_LEASE_KEY_SIZE); + return le32_to_cpu(lc.LeaseState); } static unsigned int smb2_wp_retry_size(struct inode *inode) { diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 29ec57680788..5d9b1b83284e 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -1955,15 +1955,21 @@ create_reconnect_durable_buf(struct cifs_fid *fid) } static void parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) { - struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; + u16 doff = le16_to_cpu(cc->DataOffset); + u32 dlen = le32_to_cpu(cc->DataLength); + u8 *beg; - cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", - pdisk_id->DiskFileId, pdisk_id->VolumeId); - buf->IndexNumber = pdisk_id->DiskFileId; + if (dlen < sizeof(__le64)) + return; + + beg = (u8 *)cc + doff; + memcpy(&buf->IndexNumber, beg, sizeof(__le64)); + cifs_dbg(FYI, "parse query id context 0x%llx\n", + le64_to_cpu(buf->IndexNumber)); } static void parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, struct create_posix_rsp *posix) @@ -2007,10 +2013,11 @@ int smb2_parse_contexts(struct TCP_Server_Info *server, struct create_posix_rsp *posix) { struct smb2_create_rsp *rsp = rsp_iov->iov_base; struct create_context *cc; size_t rem, off, len; + size_t cc_len; size_t doff, dlen; size_t noff, nlen; char *name; static const char smb3_create_tag_posix[] = { 0x93, 0xAD, 0x25, 0x50, 0x9C, @@ -2029,33 +2036,45 @@ int smb2_parse_contexts(struct TCP_Server_Info *server, /* Initialize inode number to 0 in case no valid data in qfid context */ if (buf) buf->IndexNumber = 0; while (rem >= sizeof(*cc)) { + off = le32_to_cpu(cc->Next); + if (off) { + if ((off & 0x7) || off >= rem || off < sizeof(*cc)) + return -EINVAL; + cc_len = off; + } else { + cc_len = rem; + } + doff = le16_to_cpu(cc->DataOffset); dlen = le32_to_cpu(cc->DataLength); - if (check_add_overflow(doff, dlen, &len) || len > rem) + if (doff < sizeof(*cc) || + check_add_overflow(doff, dlen, &len) || len > cc_len) return -EINVAL; noff = le16_to_cpu(cc->NameOffset); nlen = le16_to_cpu(cc->NameLength); - if (noff + nlen > doff) + if (noff < sizeof(*cc) || + check_add_overflow(noff, nlen, &len) || len > cc_len || + (dlen && len > doff)) return -EINVAL; name = (char *)cc + noff; switch (nlen) { case 4: - if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { + if (dlen && !strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { *oplock = server->ops->parse_lease_buf(cc, epoch, lease_key); - } else if (buf && + } else if (dlen && buf && !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { parse_query_id_ctxt(cc, buf); } break; case 16: - if (posix && !memcmp(name, smb3_create_tag_posix, 16)) + if (dlen && posix && !memcmp(name, smb3_create_tag_posix, 16)) parse_posix_ctxt(cc, buf, posix); break; default: cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", __func__, nlen, dlen); @@ -2063,17 +2082,22 @@ int smb2_parse_contexts(struct TCP_Server_Info *server, cifs_dump_mem("context data: ", cc, dlen); break; } off = le32_to_cpu(cc->Next); - if (!off) + if (!off) { + rem = 0; break; + } if (check_sub_overflow(rem, off, &rem)) return -EINVAL; cc = (struct create_context *)((u8 *)cc + off); } + if (rem) + return -EINVAL; + if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) *oplock = rsp->OplockLevel; return 0; } -- 2.52.0
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/30152 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/3IN... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/30152 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/3IN...
participants (2)
-
patchwork bot -
Zizhi Wo