| From 4012abe8a78fbb8869634130024266eaef7081fe Mon Sep 17 00:00:00 2001 |
| From: Joshua Rogers <linux@joshua.hu> |
| Date: Fri, 7 Nov 2025 00:09:37 +0800 |
| Subject: smb: client: validate change notify buffer before copy |
| |
| From: Joshua Rogers <linux@joshua.hu> |
| |
| commit 4012abe8a78fbb8869634130024266eaef7081fe upstream. |
| |
| SMB2_change_notify called smb2_validate_iov() but ignored the return |
| code, then kmemdup()ed using server provided OutputBufferOffset/Length. |
| |
| Check the return of smb2_validate_iov() and bail out on error. |
| |
| Discovered with help from the ZeroPath security tooling. |
| |
| Signed-off-by: Joshua Rogers <linux@joshua.hu> |
| Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> |
| Cc: stable@vger.kernel.org |
| Fixes: e3e9463414f61 ("smb3: improve SMB3 change notification support") |
| Signed-off-by: Steve French <stfrench@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| fs/smb/client/smb2pdu.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| --- a/fs/smb/client/smb2pdu.c |
| +++ b/fs/smb/client/smb2pdu.c |
| @@ -4068,9 +4068,12 @@ replay_again: |
| |
| smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; |
| |
| - smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), |
| - le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, |
| + rc = smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), |
| + le32_to_cpu(smb_rsp->OutputBufferLength), |
| + &rsp_iov, |
| sizeof(struct file_notify_information)); |
| + if (rc) |
| + goto cnotify_exit; |
| |
| *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), |
| le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); |
