KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

Replace 1-element arrays in fs/ksmbd/smb_common.h #242

Closed GustavoARSilva closed 1 year ago

GustavoARSilva commented 1 year ago

Audit (at least) all these places where fake flexible arrays are being used:

diff -u -p ./fs/ksmbd/smb2pdu.c /tmp/nothing/fs/ksmbd/smb2pdu.c
--- ./fs/ksmbd/smb2pdu.c
+++ /tmp/nothing/fs/ksmbd/smb2pdu.c
@@ -3334,7 +3334,6 @@ static int dentry_name(struct ksmbd_dir_

                ffdinfo = (struct file_full_directory_info *)d_info->rptr;
                d_info->rptr += le32_to_cpu(ffdinfo->NextEntryOffset);
-               d_info->name = ffdinfo->FileName;
                d_info->name_len = le32_to_cpu(ffdinfo->FileNameLength);
                return 0;
        }
@@ -3344,7 +3343,6 @@ static int dentry_name(struct ksmbd_dir_

                fbdinfo = (struct file_both_directory_info *)d_info->rptr;
                d_info->rptr += le32_to_cpu(fbdinfo->NextEntryOffset);
-               d_info->name = fbdinfo->FileName;
                d_info->name_len = le32_to_cpu(fbdinfo->FileNameLength);
                return 0;
        }
@@ -3354,7 +3352,6 @@ static int dentry_name(struct ksmbd_dir_

                fdinfo = (struct file_directory_info *)d_info->rptr;
                d_info->rptr += le32_to_cpu(fdinfo->NextEntryOffset);
-               d_info->name = fdinfo->FileName;
                d_info->name_len = le32_to_cpu(fdinfo->FileNameLength);
                return 0;
        }
@@ -3364,7 +3361,6 @@ static int dentry_name(struct ksmbd_dir_

                fninfo = (struct file_names_info *)d_info->rptr;
                d_info->rptr += le32_to_cpu(fninfo->NextEntryOffset);
-               d_info->name = fninfo->FileName;
                d_info->name_len = le32_to_cpu(fninfo->FileNameLength);
                return 0;
        }
@@ -3374,7 +3370,6 @@ static int dentry_name(struct ksmbd_dir_

                dinfo = (struct file_id_full_dir_info *)d_info->rptr;
                d_info->rptr += le32_to_cpu(dinfo->NextEntryOffset);
-               d_info->name = dinfo->FileName;
                d_info->name_len = le32_to_cpu(dinfo->FileNameLength);
                return 0;
        }
@@ -3384,7 +3379,6 @@ static int dentry_name(struct ksmbd_dir_

                fibdinfo = (struct file_id_both_directory_info *)d_info->rptr;
                d_info->rptr += le32_to_cpu(fibdinfo->NextEntryOffset);
-               d_info->name = fibdinfo->FileName;
                d_info->name_len = le32_to_cpu(fibdinfo->FileNameLength);
                return 0;
        }
@@ -3465,7 +3459,6 @@ static int smb2_populate_readdir_entry(s
                        ffdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE;
                if (d_info->hide_dot_file && d_info->name[0] == '.')
                        ffdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE;
-               memcpy(ffdinfo->FileName, conv_name, conv_len);
                ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
        }
@@ -3483,7 +3476,6 @@ static int smb2_populate_readdir_entry(s
                fbdinfo->Reserved = 0;
                if (d_info->hide_dot_file && d_info->name[0] == '.')
                        fbdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE;
-               memcpy(fbdinfo->FileName, conv_name, conv_len);
                fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
        }
@@ -3495,7 +3487,6 @@ static int smb2_populate_readdir_entry(s
                fdinfo->FileNameLength = cpu_to_le32(conv_len);
                if (d_info->hide_dot_file && d_info->name[0] == '.')
                        fdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE;
-               memcpy(fdinfo->FileName, conv_name, conv_len);
                fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
        }
@@ -3505,7 +3496,6 @@ static int smb2_populate_readdir_entry(s

                fninfo = (struct file_names_info *)kstat;
                fninfo->FileNameLength = cpu_to_le32(conv_len);
-               memcpy(fninfo->FileName, conv_name, conv_len);
                fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
        }
@@ -3523,7 +3513,6 @@ static int smb2_populate_readdir_entry(s
                dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino);
                if (d_info->hide_dot_file && d_info->name[0] == '.')
                        dinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE;
-               memcpy(dinfo->FileName, conv_name, conv_len);
                dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
        }
@@ -3543,7 +3532,6 @@ static int smb2_populate_readdir_entry(s
                fibdinfo->Reserved2 = cpu_to_le16(0);
                if (d_info->hide_dot_file && d_info->name[0] == '.')
                        fibdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE;
-               memcpy(fibdinfo->FileName, conv_name, conv_len);
                fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
        }
@@ -3704,8 +3692,6 @@ static int reserve_populate_dentry(struc
                struct file_full_directory_info *ffdinfo;

                ffdinfo = (struct file_full_directory_info *)d_info->wptr;
-               memcpy(ffdinfo->FileName, d_info->name, d_info->name_len);
-               ffdinfo->FileName[d_info->name_len] = 0x00;
                ffdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
                ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
@@ -3715,8 +3701,6 @@ static int reserve_populate_dentry(struc
                struct file_both_directory_info *fbdinfo;

                fbdinfo = (struct file_both_directory_info *)d_info->wptr;
-               memcpy(fbdinfo->FileName, d_info->name, d_info->name_len);
-               fbdinfo->FileName[d_info->name_len] = 0x00;
                fbdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
                fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
@@ -3726,8 +3710,6 @@ static int reserve_populate_dentry(struc
                struct file_directory_info *fdinfo;

                fdinfo = (struct file_directory_info *)d_info->wptr;
-               memcpy(fdinfo->FileName, d_info->name, d_info->name_len);
-               fdinfo->FileName[d_info->name_len] = 0x00;
                fdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
                fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
@@ -3737,8 +3719,6 @@ static int reserve_populate_dentry(struc
                struct file_names_info *fninfo;

                fninfo = (struct file_names_info *)d_info->wptr;
-               memcpy(fninfo->FileName, d_info->name, d_info->name_len);
-               fninfo->FileName[d_info->name_len] = 0x00;
                fninfo->FileNameLength = cpu_to_le32(d_info->name_len);
                fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
@@ -3748,8 +3728,6 @@ static int reserve_populate_dentry(struc
                struct file_id_full_dir_info *dinfo;

                dinfo = (struct file_id_full_dir_info *)d_info->wptr;
-               memcpy(dinfo->FileName, d_info->name, d_info->name_len);
-               dinfo->FileName[d_info->name_len] = 0x00;
                dinfo->FileNameLength = cpu_to_le32(d_info->name_len);
                dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
@@ -3759,8 +3737,6 @@ static int reserve_populate_dentry(struc
                struct file_id_both_directory_info *fibdinfo;

                fibdinfo = (struct file_id_both_directory_info *)d_info->wptr;
-               memcpy(fibdinfo->FileName, d_info->name, d_info->name_len);
-               fibdinfo->FileName[d_info->name_len] = 0x00;
                fibdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
                fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
                break;
GustavoARSilva commented 1 year ago

https://lore.kernel.org/linux-hardening/Y3OxronfaPYv9qGP@work/