Closed mmakassikis closed 3 years ago
Thanks for your report and patch. I prefer to add more simple code.
+ if ((strlen(account) >= KSMBD_REQ_MAX_ACCOUNT_NAME_SZ)
+ return NULL;
+ strcpy(req->acount, account);
How about this ?
On (20/11/05 08:49), mmakassikis wrote:
The offending code in ksmbd_ipc_login_request() seems to be the following:
511 512 msg->type = KSMBD_EVENT_LOGIN_REQUEST; 513 req = KSMBD_IPC_MSG_PAYLOAD(msg); 514 req->handle = ksmbd_acquire_id(ida); 515 memcpy(req->account, account, sizeof(req->account) - 1); 516
memcpy() is definitely wrong there. Would be better to use a proper string copy function instead - strcpy().
-ss
On (20/11/05 16:14), Namjae Jeon wrote:
Thanks for your report and patch. I prefer to add more simple code.
- if ((strlen(account) >= KSMBD_REQ_MAX_ACCOUNT_NAME_SZ)
- return NULL;
strcpy(req->acount, account);
How about this ?
This leaks the allocated req memory. The check should be done before msg = ipc_msg_alloc(), so that we won't even bother to allocate req for such case.
-ss
This leaks the allocated req memory. The check should be done before msg = ipc_msg_alloc(), so that we won't even bother to allocate req for such case.
Right. size check should be moved to above msg = ipc_msg_alloc().
@mmakassikis Could you please check the following change and send the patch to the mailing list(linux-cifsd-devel@lists.sourceforge.net)
+ if ((strlen(account) >= KSMBD_REQ_MAX_ACCOUNT_NAME_SZ)
+ return NULL;
msg = ipc_msg_alloc(sizeof(struct ksmbd_login_request));
.....
- memcpy(req->account, account, sizeof(req->account) - 1);
+ strcpy(req->acount, account);
I've sent a patch on the mailing list which uses strlcpy/strscpy instead of strcpy as you suggested. I've also changed other memcpy calls in the same file that dealt with strings to also use strlcpy/strscpy.
@mmakassikis I pushed your patch to git tree. It will be merged into cifsd-team tree soon. Thanks!
Hello,
On a kernel compiled with CONFIG_KASAN=y and CONFIG_STACKTRACE=y, I see the following report in dmesg:
The offending code in ksmbd_ipc_login_request() seems to be the following:
The memcpy() call copies 'sizeof(req->account) - 1' bytes to the req->account. In doing so, it reads past the end of the 'account' buffer.
With the following patch, I no longer see the KASAN warning:
If my understanding is correct, `account' is built with the smb_strndup_from_utf16() function that nul-terminates the buffer, so it's ok to use strlen() to determine the buffer's size.
Thoughts ?