smb: client: fix potential OOBs in smb2_parse_contexts()

[platform/kernel/linux-starfive.git] / fs / smb / client / smb2pdu.c

diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index c75a80b..2df1185 100644 (file)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2141,17 +2141,18 @@ parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info,
                 posix->nlink, posix->mode, posix->reparse_tag);
 }
 
-void
-smb2_parse_contexts(struct TCP_Server_Info *server,
-                   struct smb2_create_rsp *rsp,
-                   unsigned int *epoch, char *lease_key, __u8 *oplock,
-                   struct smb2_file_all_info *buf,
-                   struct create_posix_rsp *posix)
+int smb2_parse_contexts(struct TCP_Server_Info *server,
+                       struct kvec *rsp_iov,
+                       unsigned int *epoch,
+                       char *lease_key, __u8 *oplock,
+                       struct smb2_file_all_info *buf,
+                       struct create_posix_rsp *posix)
 {
-       char *data_offset;
+       struct smb2_create_rsp *rsp = rsp_iov->iov_base;
        struct create_context *cc;
-       unsigned int next;
-       unsigned int remaining;
+       size_t rem, off, len;
+       size_t doff, dlen;
+       size_t noff, nlen;
        char *name;
        static const char smb3_create_tag_posix[] = {
                0x93, 0xAD, 0x25, 0x50, 0x9C,
@@ -2160,45 +2161,63 @@ smb2_parse_contexts(struct TCP_Server_Info *server,
        };
 
        *oplock = 0;
-       data_offset = (char *)rsp + le32_to_cpu(rsp->CreateContextsOffset);
-       remaining = le32_to_cpu(rsp->CreateContextsLength);
-       cc = (struct create_context *)data_offset;
+
+       off = le32_to_cpu(rsp->CreateContextsOffset);
+       rem = le32_to_cpu(rsp->CreateContextsLength);
+       if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len)
+               return -EINVAL;
+       cc = (struct create_context *)((u8 *)rsp + off);
 
        /* Initialize inode number to 0 in case no valid data in qfid context */
        if (buf)
                buf->IndexNumber = 0;
 
-       while (remaining >= sizeof(struct create_context)) {
-               name = le16_to_cpu(cc->NameOffset) + (char *)cc;
-               if (le16_to_cpu(cc->NameLength) == 4 &&
-                   strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4) == 0)
-                       *oplock = server->ops->parse_lease_buf(cc, epoch,
-                                                          lease_key);
-               else if (buf && (le16_to_cpu(cc->NameLength) == 4) &&
-                   strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4) == 0)
-                       parse_query_id_ctxt(cc, buf);
-               else if ((le16_to_cpu(cc->NameLength) == 16)) {
-                       if (posix &&
-                           memcmp(name, smb3_create_tag_posix, 16) == 0)
+       while (rem >= sizeof(*cc)) {
+               doff = le16_to_cpu(cc->DataOffset);
+               dlen = le32_to_cpu(cc->DataLength);
+               if (check_add_overflow(doff, dlen, &len) || len > rem)
+                       return -EINVAL;
+
+               noff = le16_to_cpu(cc->NameOffset);
+               nlen = le16_to_cpu(cc->NameLength);
+               if (noff + nlen >= doff)
+                       return -EINVAL;
+
+               name = (char *)cc + noff;
+               switch (nlen) {
+               case 4:
+                       if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) {
+                               *oplock = server->ops->parse_lease_buf(cc, epoch,
+                                                                      lease_key);
+                       } else if (buf &&
+                                  !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) {
+                               parse_query_id_ctxt(cc, buf);
+                       }
+                       break;
+               case 16:
+                       if (posix && !memcmp(name, smb3_create_tag_posix, 16))
                                parse_posix_ctxt(cc, buf, posix);
+                       break;
+               default:
+                       cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n",
+                                __func__, nlen, dlen);
+                       if (IS_ENABLED(CONFIG_CIFS_DEBUG2))
+                               cifs_dump_mem("context data: ", cc, dlen);
+                       break;
                }
-               /* else {
-                       cifs_dbg(FYI, "Context not matched with len %d\n",
-                               le16_to_cpu(cc->NameLength));
-                       cifs_dump_mem("Cctxt name: ", name, 4);
-               } */
-
-               next = le32_to_cpu(cc->Next);
-               if (!next)
+
+               off = le32_to_cpu(cc->Next);
+               if (!off)
                        break;
-               remaining -= next;
-               cc = (struct create_context *)((char *)cc + next);
+               if (check_sub_overflow(rem, off, &rem))
+                       return -EINVAL;
+               cc = (struct create_context *)((u8 *)cc + off);
        }
 
        if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE)
                *oplock = rsp->OplockLevel;
 
-       return;
+       return 0;
 }
 
 static int
@@ -3029,8 +3048,8 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
        }
 
 
-       smb2_parse_contexts(server, rsp, &oparms->fid->epoch,
-                           oparms->fid->lease_key, oplock, buf, posix);
+       rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch,
+                                oparms->fid->lease_key, oplock, buf, posix);
 creat_exit:
        SMB2_open_free(&rqst);
        free_rsp_buf(resp_buftype, rsp);