[PATCH RESEND] cifs: bound invalid NTLMSSP signature diagnostic

[PATCH RESEND] cifs: bound invalid NTLMSSP signature diagnostic

[Yifan Zhang]

The NTLMSSP Signature field is an eight-byte binary value and need not be
NUL-terminated. decode_ntlmssp_challenge() prints it with %s on the
signature-mismatch path, so the diagnostic can continue beyond the received
blob until it encounters a zero byte.

KASAN reports:

  BUG: KASAN: slab-out-of-bounds in string
  Read of size 1
  string
  vsnprintf
  _printk
  decode_ntlmssp_challenge

Print the fixed-width field with the bounded hexadecimal format.

The patched kernel reaches the invalid-signature path and returns -EINVAL
without a KASAN report.

Fixes: 0b3cc858003b ("[CIFS] NTLMSSP reenabled after move from connect.c to sess.c")
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
---
 fs/smb/client/sess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
index c1fc90726e2d1..00c9c99c6701a 100644
--- a/fs/smb/client/sess.c
+++ b/fs/smb/client/sess.c
@@ -666,7 +666,7 @@ int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
 	}
 
 	if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
-		cifs_dbg(VFS, "blob signature incorrect %s\n",
+		cifs_dbg(VFS, "blob signature incorrect %8phN\n",
 			 pblob->Signature);
 		return -EINVAL;
 	}
-- 
2.39.5 (Apple Git-154)

Re: [PATCH RESEND] cifs: bound invalid NTLMSSP signature diagnostic

[Paulo Alcantara]

Yifan Zhang <yfzhang23@stu.pku.edu.cn> writes:

> The NTLMSSP Signature field is an eight-byte binary value and need not be
> NUL-terminated. decode_ntlmssp_challenge() prints it with %s on the
> signature-mismatch path, so the diagnostic can continue beyond the received
> blob until it encounters a zero byte.
>
> KASAN reports:
>
>   BUG: KASAN: slab-out-of-bounds in string
>   Read of size 1
>   string
>   vsnprintf
>   _printk
>   decode_ntlmssp_challenge
>
> Print the fixed-width field with the bounded hexadecimal format.
> ...

Applied.