[PATCH OLK-5.10 0/2] Fix CVE-2025-37947
Fix CVE-2025-37947 Namjae Jeon (1): ksmbd: fix stream write failure Norbert Szetei (1): ksmbd: prevent out-of-bounds stream writes by validating *pos fs/ksmbd/vfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.39.2
From: Norbert Szetei <norbert@doyensec.com> mainline inclusion from mainline-v6.15-rc6 commit 0ca6df4f40cf4c32487944aaf48319cb6c25accc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/10216 CVE: CVE-2025-37947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). If *pos was greater than or equal to v_len, this could lead to an out-of-bounds memory write. This patch adds a check to ensure *pos is less than v_len before proceeding. If the condition fails, -EINVAL is returned. Cc: stable@vger.kernel.org Signed-off-by: Norbert Szetei <norbert@doyensec.com> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Conflicts: fs/smb/server/vfs.c fs/ksmbd/vfs.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6@huawei.com> Signed-off-by: Long Li <leo.lilong@huawei.com> --- fs/ksmbd/vfs.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ksmbd/vfs.c b/fs/ksmbd/vfs.c index 7fd796880c7c..9ad95009393a 100644 --- a/fs/ksmbd/vfs.c +++ b/fs/ksmbd/vfs.c @@ -425,6 +425,13 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, goto out; } + if (v_len <= *pos) { + pr_err("stream write position %lld is out of bounds (stream length: %zd)\n", + *pos, v_len); + err = -EINVAL; + goto out; + } + if (v_len < size) { wbuf = kvmalloc(size, GFP_KERNEL | __GFP_ZERO); if (!wbuf) { -- 2.39.2
From: Namjae Jeon <linkinjeon@kernel.org> mainline inclusion from mainline-v6.15 commit 1f4bbedd4e5a69b01cde2cc21d01151ab2d0884f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/10216 CVE: CVE-2025-37947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- If there is no stream data in file, v_len is zero. So, If position(*pos) is zero, stream write will fail due to stream write position validation check. This patch reorganize stream write position validation. Fixes: 0ca6df4f40cf ("ksmbd: prevent out-of-bounds stream writes by validating *pos") Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Conflicts: fs/smb/server/vfs.c fs/ksmbd/vfs.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6@huawei.com> Signed-off-by: Long Li <leo.lilong@huawei.com> --- fs/ksmbd/vfs.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/fs/ksmbd/vfs.c b/fs/ksmbd/vfs.c index 9ad95009393a..94169255e01b 100644 --- a/fs/ksmbd/vfs.c +++ b/fs/ksmbd/vfs.c @@ -409,10 +409,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n", *pos, count); + if (*pos >= XATTR_SIZE_MAX) { + pr_err("stream write position %lld is out of bounds\n", *pos); + return -EINVAL; + } + size = *pos + count; if (size > XATTR_SIZE_MAX) { size = XATTR_SIZE_MAX; - count = (*pos + count) - XATTR_SIZE_MAX; + count = XATTR_SIZE_MAX - *pos; } v_len = ksmbd_vfs_getcasexattr(fp->filp->f_path.dentry, @@ -425,13 +430,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, goto out; } - if (v_len <= *pos) { - pr_err("stream write position %lld is out of bounds (stream length: %zd)\n", - *pos, v_len); - err = -EINVAL; - goto out; - } - if (v_len < size) { wbuf = kvmalloc(size, GFP_KERNEL | __GFP_ZERO); if (!wbuf) { -- 2.39.2
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/20335 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/LK5... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/20335 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/LK5...
participants (2)
-
Long Li -
patchwork bot