Closed GustavoARSilva closed 1 year ago
Audit (at least) all these places where fake flexible arrays are being used:
diff -u -p ./fs/ksmbd/smb2pdu.c /tmp/nothing/fs/ksmbd/smb2pdu.c --- ./fs/ksmbd/smb2pdu.c +++ /tmp/nothing/fs/ksmbd/smb2pdu.c @@ -3334,7 +3334,6 @@ static int dentry_name(struct ksmbd_dir_ ffdinfo = (struct file_full_directory_info *)d_info->rptr; d_info->rptr += le32_to_cpu(ffdinfo->NextEntryOffset); - d_info->name = ffdinfo->FileName; d_info->name_len = le32_to_cpu(ffdinfo->FileNameLength); return 0; } @@ -3344,7 +3343,6 @@ static int dentry_name(struct ksmbd_dir_ fbdinfo = (struct file_both_directory_info *)d_info->rptr; d_info->rptr += le32_to_cpu(fbdinfo->NextEntryOffset); - d_info->name = fbdinfo->FileName; d_info->name_len = le32_to_cpu(fbdinfo->FileNameLength); return 0; } @@ -3354,7 +3352,6 @@ static int dentry_name(struct ksmbd_dir_ fdinfo = (struct file_directory_info *)d_info->rptr; d_info->rptr += le32_to_cpu(fdinfo->NextEntryOffset); - d_info->name = fdinfo->FileName; d_info->name_len = le32_to_cpu(fdinfo->FileNameLength); return 0; } @@ -3364,7 +3361,6 @@ static int dentry_name(struct ksmbd_dir_ fninfo = (struct file_names_info *)d_info->rptr; d_info->rptr += le32_to_cpu(fninfo->NextEntryOffset); - d_info->name = fninfo->FileName; d_info->name_len = le32_to_cpu(fninfo->FileNameLength); return 0; } @@ -3374,7 +3370,6 @@ static int dentry_name(struct ksmbd_dir_ dinfo = (struct file_id_full_dir_info *)d_info->rptr; d_info->rptr += le32_to_cpu(dinfo->NextEntryOffset); - d_info->name = dinfo->FileName; d_info->name_len = le32_to_cpu(dinfo->FileNameLength); return 0; } @@ -3384,7 +3379,6 @@ static int dentry_name(struct ksmbd_dir_ fibdinfo = (struct file_id_both_directory_info *)d_info->rptr; d_info->rptr += le32_to_cpu(fibdinfo->NextEntryOffset); - d_info->name = fibdinfo->FileName; d_info->name_len = le32_to_cpu(fibdinfo->FileNameLength); return 0; } @@ -3465,7 +3459,6 @@ static int smb2_populate_readdir_entry(s ffdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; if (d_info->hide_dot_file && d_info->name[0] == '.') ffdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; - memcpy(ffdinfo->FileName, conv_name, conv_len); ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; } @@ -3483,7 +3476,6 @@ static int smb2_populate_readdir_entry(s fbdinfo->Reserved = 0; if (d_info->hide_dot_file && d_info->name[0] == '.') fbdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; - memcpy(fbdinfo->FileName, conv_name, conv_len); fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; } @@ -3495,7 +3487,6 @@ static int smb2_populate_readdir_entry(s fdinfo->FileNameLength = cpu_to_le32(conv_len); if (d_info->hide_dot_file && d_info->name[0] == '.') fdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; - memcpy(fdinfo->FileName, conv_name, conv_len); fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; } @@ -3505,7 +3496,6 @@ static int smb2_populate_readdir_entry(s fninfo = (struct file_names_info *)kstat; fninfo->FileNameLength = cpu_to_le32(conv_len); - memcpy(fninfo->FileName, conv_name, conv_len); fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; } @@ -3523,7 +3513,6 @@ static int smb2_populate_readdir_entry(s dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); if (d_info->hide_dot_file && d_info->name[0] == '.') dinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; - memcpy(dinfo->FileName, conv_name, conv_len); dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; } @@ -3543,7 +3532,6 @@ static int smb2_populate_readdir_entry(s fibdinfo->Reserved2 = cpu_to_le16(0); if (d_info->hide_dot_file && d_info->name[0] == '.') fibdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; - memcpy(fibdinfo->FileName, conv_name, conv_len); fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; } @@ -3704,8 +3692,6 @@ static int reserve_populate_dentry(struc struct file_full_directory_info *ffdinfo; ffdinfo = (struct file_full_directory_info *)d_info->wptr; - memcpy(ffdinfo->FileName, d_info->name, d_info->name_len); - ffdinfo->FileName[d_info->name_len] = 0x00; ffdinfo->FileNameLength = cpu_to_le32(d_info->name_len); ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; @@ -3715,8 +3701,6 @@ static int reserve_populate_dentry(struc struct file_both_directory_info *fbdinfo; fbdinfo = (struct file_both_directory_info *)d_info->wptr; - memcpy(fbdinfo->FileName, d_info->name, d_info->name_len); - fbdinfo->FileName[d_info->name_len] = 0x00; fbdinfo->FileNameLength = cpu_to_le32(d_info->name_len); fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; @@ -3726,8 +3710,6 @@ static int reserve_populate_dentry(struc struct file_directory_info *fdinfo; fdinfo = (struct file_directory_info *)d_info->wptr; - memcpy(fdinfo->FileName, d_info->name, d_info->name_len); - fdinfo->FileName[d_info->name_len] = 0x00; fdinfo->FileNameLength = cpu_to_le32(d_info->name_len); fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; @@ -3737,8 +3719,6 @@ static int reserve_populate_dentry(struc struct file_names_info *fninfo; fninfo = (struct file_names_info *)d_info->wptr; - memcpy(fninfo->FileName, d_info->name, d_info->name_len); - fninfo->FileName[d_info->name_len] = 0x00; fninfo->FileNameLength = cpu_to_le32(d_info->name_len); fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; @@ -3748,8 +3728,6 @@ static int reserve_populate_dentry(struc struct file_id_full_dir_info *dinfo; dinfo = (struct file_id_full_dir_info *)d_info->wptr; - memcpy(dinfo->FileName, d_info->name, d_info->name_len); - dinfo->FileName[d_info->name_len] = 0x00; dinfo->FileNameLength = cpu_to_le32(d_info->name_len); dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break; @@ -3759,8 +3737,6 @@ static int reserve_populate_dentry(struc struct file_id_both_directory_info *fibdinfo; fibdinfo = (struct file_id_both_directory_info *)d_info->wptr; - memcpy(fibdinfo->FileName, d_info->name, d_info->name_len); - fibdinfo->FileName[d_info->name_len] = 0x00; fibdinfo->FileNameLength = cpu_to_le32(d_info->name_len); fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); break;
https://lore.kernel.org/linux-hardening/Y3OxronfaPYv9qGP@work/
Audit (at least) all these places where fake flexible arrays are being used: