[PATCH] smb: client: fix OOB write when compounding SMB2_IOCTL with encryption

[PATCH] smb: client: fix OOB write when compounding SMB2_IOCTL with encryption

[Andrey Misiurov]

On an encrypted ("seal") mount, SMB2_ioctl_init() keeps the IOCTL input
in a separate iov (iov[1]); iov[0] is a 448-byte buffer from
cifs_small_buf_get().  When such an IOCTL is not the last request of a
compound, smb2_set_next_command() pads it for alignment by copying the
whole request into iov[0].  A large enough input overflows that 448-byte
buffer and corrupts the slab; the copy also sets rq_nvec to 1, so the
input buffer is leaked too.

An unprivileged user can trigger it by creating a symlink with a long
target on such a mount: the native symlink is sent as
FSCTL_SET_REPARSE_POINT + QUERY_INFO + CLOSE in one compound, so the
IOCTL is not the last request.

With slub_debug red zones on the cifs_small_rq cache, the overflow is
caught on the next allocation from that cache in the same compound (the
0x61 bytes are the 'a' characters of the symlink target):

  BUG cifs_small_rq (Not tainted): Object corrupt
  [Left Redzone overwritten] 0xffff8a59c7790500-0xffff8a59c779053f First byte 0x61 instead of 0xbb
  Call Trace:
   check_object+0x1a8/0x350
   alloc_debug_processing+0xab/0x110
   ___slab_alloc+0x7e/0x2f0
   kmem_cache_alloc_noprof+0x28d/0x4b0
   mempool_alloc_slab+0x16/0x30
   cifs_small_buf_get+0x1a/0x30 [cifs]
   SMB2_close_init+0x8a/0x100 [cifs]
   smb2_compound_op+0x2571/0x2b50 [cifs]
   smb2_create_reparse_inode+0x27e/0x490 [cifs]
   mknod_nfs+0x1ce/0x2e0 [cifs]
   create_reparse_symlink+0x119/0x180 [cifs]
   cifs_symlink+0x19f/0x8e0 [cifs]
   vfs_symlink+0xa3/0x1b0
   __x64_sys_symlink+0x41/0x70

Pad the input to a multiple of 8 bytes when encryption is required.  The
request is then already aligned and smb2_set_next_command() no longer
copies it; InputCount still carries the real length.

Fixes: 90f7c100d2dd ("smb: client: fix compound alignment with encryption")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Misiurov <andrey.misyrov@gmail.com>
---
 fs/smb/client/smb2pdu.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index b140ec0a71a8..71d9b698c208 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -3432,6 +3432,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
 	unsigned int total_len;
 	int rc;
 	char *in_data_buf;
+	u32 in_buf_len = indatalen;
 
 	rc = smb2_ioctl_req_init(opcode, tcon, server,
 				 (void **) &req, &total_len);
@@ -3439,15 +3440,18 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
 		return rc;
 
 	if (indatalen) {
+		if (smb3_encryption_required(tcon))
+			in_buf_len = ALIGN(indatalen, 8);
 		/*
 		 * indatalen is usually small at a couple of bytes max, so
 		 * just allocate through generic pool
 		 */
-		in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS);
+		in_data_buf = kzalloc(in_buf_len, GFP_NOFS);
 		if (!in_data_buf) {
 			cifs_small_buf_release(req);
 			return -ENOMEM;
 		}
+		memcpy(in_data_buf, in_data, indatalen);
 	}
 
 	req->CtlCode = cpu_to_le32(opcode);
@@ -3471,7 +3482,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
 		rqst->rq_nvec = 2;
 		iov[0].iov_len = total_len - 1;
 		iov[1].iov_base = in_data_buf;
-		iov[1].iov_len = indatalen;
+		iov[1].iov_len = in_buf_len;
 	} else {
 		rqst->rq_nvec = 1;
 		iov[0].iov_len = total_len;
-- 
2.47.3

Re: [PATCH] smb: client: fix OOB write when compounding SMB2_IOCTL with encryption

[Namjae Jeon]

On Sat, Oct 31, 2026 at 6:38 AM Andrey Misiurov
<andrey.misyrov@gmail.com> wrote:
>
> On an encrypted ("seal") mount, SMB2_ioctl_init() keeps the IOCTL input
> in a separate iov (iov[1]); iov[0] is a 448-byte buffer from
> cifs_small_buf_get().  When such an IOCTL is not the last request of a
> compound, smb2_set_next_command() pads it for alignment by copying the
> whole request into iov[0].  A large enough input overflows that 448-byte
> buffer and corrupts the slab; the copy also sets rq_nvec to 1, so the
> input buffer is leaked too.
>
> An unprivileged user can trigger it by creating a symlink with a long
> target on such a mount: the native symlink is sent as
> FSCTL_SET_REPARSE_POINT + QUERY_INFO + CLOSE in one compound, so the
> IOCTL is not the last request.
>
> With slub_debug red zones on the cifs_small_rq cache, the overflow is
> caught on the next allocation from that cache in the same compound (the
> 0x61 bytes are the 'a' characters of the symlink target):
>
>   BUG cifs_small_rq (Not tainted): Object corrupt
>   [Left Redzone overwritten] 0xffff8a59c7790500-0xffff8a59c779053f First byte 0x61 instead of 0xbb
>   Call Trace:
>    check_object+0x1a8/0x350
>    alloc_debug_processing+0xab/0x110
>    ___slab_alloc+0x7e/0x2f0
>    kmem_cache_alloc_noprof+0x28d/0x4b0
>    mempool_alloc_slab+0x16/0x30
>    cifs_small_buf_get+0x1a/0x30 [cifs]
>    SMB2_close_init+0x8a/0x100 [cifs]
>    smb2_compound_op+0x2571/0x2b50 [cifs]
>    smb2_create_reparse_inode+0x27e/0x490 [cifs]
>    mknod_nfs+0x1ce/0x2e0 [cifs]
>    create_reparse_symlink+0x119/0x180 [cifs]
>    cifs_symlink+0x19f/0x8e0 [cifs]
>    vfs_symlink+0xa3/0x1b0
>    __x64_sys_symlink+0x41/0x70
>
> Pad the input to a multiple of 8 bytes when encryption is required.  The
> request is then already aligned and smb2_set_next_command() no longer
> copies it; InputCount still carries the real length.
>
> Fixes: 90f7c100d2dd ("smb: client: fix compound alignment with encryption")
> Cc: stable@vger.kernel.org
> Signed-off-by: Andrey Misiurov <andrey.misyrov@gmail.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks.

Re: [PATCH] smb: client: fix OOB write when compounding SMB2_IOCTL with encryption

[Paulo Alcantara]

Andrey Misiurov <andrey.misyrov@gmail.com> writes:

> On an encrypted ("seal") mount, SMB2_ioctl_init() keeps the IOCTL input
> in a separate iov (iov[1]); iov[0] is a 448-byte buffer from
> cifs_small_buf_get().  When such an IOCTL is not the last request of a
> compound, smb2_set_next_command() pads it for alignment by copying the
> whole request into iov[0].  A large enough input overflows that 448-byte
> buffer and corrupts the slab; the copy also sets rq_nvec to 1, so the
> input buffer is leaked too.
>
> An unprivileged user can trigger it by creating a symlink with a long
> target on such a mount: the native symlink is sent as
> FSCTL_SET_REPARSE_POINT + QUERY_INFO + CLOSE in one compound, so the
> IOCTL is not the last request.
>
> With slub_debug red zones on the cifs_small_rq cache, the overflow is
> caught on the next allocation from that cache in the same compound (the
> 0x61 bytes are the 'a' characters of the symlink target):
>
>   BUG cifs_small_rq (Not tainted): Object corrupt
>   [Left Redzone overwritten] 0xffff8a59c7790500-0xffff8a59c779053f First byte 0x61 instead of 0xbb
>   Call Trace:
>    check_object+0x1a8/0x350
>    alloc_debug_processing+0xab/0x110
>    ___slab_alloc+0x7e/0x2f0
>    kmem_cache_alloc_noprof+0x28d/0x4b0
>    mempool_alloc_slab+0x16/0x30
>    cifs_small_buf_get+0x1a/0x30 [cifs]
>    SMB2_close_init+0x8a/0x100 [cifs]
>    smb2_compound_op+0x2571/0x2b50 [cifs]
>    smb2_create_reparse_inode+0x27e/0x490 [cifs]
>    mknod_nfs+0x1ce/0x2e0 [cifs]
>    create_reparse_symlink+0x119/0x180 [cifs]
>    cifs_symlink+0x19f/0x8e0 [cifs]
>    vfs_symlink+0xa3/0x1b0
>    __x64_sys_symlink+0x41/0x70
>
> Pad the input to a multiple of 8 bytes when encryption is required.  The
> request is then already aligned and smb2_set_next_command() no longer
> copies it; InputCount still carries the real length.
> ...

Applied.