mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH 0/3] smb: client: validate SMB1 write and query response lengths
@ 2026-09-11 14:57 Diego Oliva
  2026-09-11 14:57 ` [PATCH 1/3] smb: client: reject short WRITE responses in the SMB1 write paths Diego Oliva
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Diego Oliva @ 2026-09-11 14:57 UTC (permalink / raw)
  To: Paulo Alcantara, Namjae Jeon, linux-cifs
  Cc: Ronnie Sahlberg, Shyam Prasad N, Tom Talpey, Bharath SM,
	David Howells, Jeff Layton, samba-technical, linux-kernel

Three fixes for SMB1 reply parsers that dereference a response struct
without first establishing that the response was long enough to hold
it. They are the same class of defect as the recent "smb: client:
reject short READ responses in CIFSSMBRead()", generalised to the
write and legacy query paths.

checkSMB() only requires the RFC1002 length to agree with WordCount
and the byte count; it does not check either against what the command
in question requires. Every fixed-layout SMB1 response struct is
therefore unguarded unless its own parser checks: a reply carrying a
smaller WordCount than the command expects is accepted and handed to
the parser with rc == 0, and the smallest such reply is 35 bytes, a
header with WordCount and ByteCount both zero.

Patch 1 adds the missing minimum-length check to the three WRITE_RSP
parsers, and patch 3 does the same for SMBQueryInformation(). In each
case the size required is exactly the smallest reply a conforming
server can send for the word count the response is documented to
carry, so no legitimate server can be rejected:

  sizeof(WRITE_RSP)              wct = 6    33 + 2*6  + 2 = 47
  sizeof(QUERY_INFORMATION_RSP)  wct = 10   33 + 2*10 + 2 = 55

where 33 is sizeof(struct smb_hdr) and the trailing 2 is ByteCount.

Patch 2 is a different bug in one of the same parsers.
cifs_writev_callback() accepts a byte count larger than the length it
asked to write - the existing OS/2 workaround only masks off the high
16 bits - and hands it to netfs, which answers with a WARN() from
netfs_write_subrequest_terminated(). Before netfs clamps the value,
cifs_write_subrequest_terminated() has already used it to grow the
client's idea of the file size. Reject the reply instead.

All three use smb_EIO2(), introduced in v6.19, so they do not apply to
older stable trees as-is, and substituting plain -EIO is not enough on
its own: older trees shape struct smb_hdr and struct mid_q_entry
differently, so both the sizeof() bounds these patches test against and
the response length patch 1 reads out of the mid need reworking.

Diego Oliva (3):
  smb: client: reject short WRITE responses in the SMB1 write paths
  smb: client: reject over-long write counts in cifs_writev_callback()
  smb: client: reject short responses in SMBQueryInformation()

 fs/smb/client/cifssmb.c | 36 ++++++++++++++++++++++++++++++++++++
 fs/smb/client/trace.h   |  3 +++
 2 files changed, 39 insertions(+)


base-commit: 0a96d0d726cd380423ac38e2c28f538db2940a1d
-- 
2.39.5


^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-13 19:03 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 14:57 [PATCH 0/3] smb: client: validate SMB1 write and query response lengths Diego Oliva
2026-09-11 14:57 ` [PATCH 1/3] smb: client: reject short WRITE responses in the SMB1 write paths Diego Oliva
2026-09-13 19:03   ` Paulo Alcantara
2026-09-11 14:57 ` [PATCH 2/3] smb: client: reject over-long write counts in cifs_writev_callback() Diego Oliva
2026-09-11 14:57 ` [PATCH 3/3] smb: client: reject short responses in SMBQueryInformation() Diego Oliva

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®