Unverified Commit 1b76c0e6 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9827 ksmbd: fix slab out of bounds write in smb_inherit_dacl() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Zhaolong <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/DXYKXZ62Z65PCO2IOPDSAWKXEW3EJ2PG/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9R4LC 
 
Link:https://gitee.com/openeuler/kernel/pulls/9827

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 77e21e0e dedbf400

fs/ksmbd/smbacl.c

+26 −3
Original line number Diff line number Diff line
@@ -1098,6 +1098,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, 
		struct smb_acl *pdacl;

		struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL;

		int powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size;

		int pntsd_alloc_size;



		if (parent_pntsd->osidoffset) {

			powner_sid = (struct smb_sid *)((char *)parent_pntsd +
@@ -1110,9 +1111,10 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, 
			pgroup_sid_size = 1 + 1 + 6 + (pgroup_sid->num_subauth * 4);

		}



		pntsd = kzalloc(sizeof(struct smb_ntsd) + powner_sid_size +

				pgroup_sid_size + sizeof(struct smb_acl) +

				nt_size, GFP_KERNEL);

		pntsd_alloc_size = sizeof(struct smb_ntsd) + powner_sid_size +

			pgroup_sid_size + sizeof(struct smb_acl) + nt_size;



		pntsd = kzalloc(pntsd_alloc_size, GFP_KERNEL);

		if (!pntsd) {

			rc = -ENOMEM;

			goto free_aces_base;
@@ -1127,6 +1129,27 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, 
		pntsd->gsidoffset = parent_pntsd->gsidoffset;

		pntsd->dacloffset = parent_pntsd->dacloffset;



		if ((u64)le32_to_cpu(pntsd->osidoffset) + powner_sid_size >

		    pntsd_alloc_size) {

			rc = -EINVAL;

			kfree(pntsd);

			goto free_aces_base;

		}



		if ((u64)le32_to_cpu(pntsd->gsidoffset) + pgroup_sid_size >

		    pntsd_alloc_size) {

			rc = -EINVAL;

			kfree(pntsd);

			goto free_aces_base;

		}



		if ((u64)le32_to_cpu(pntsd->dacloffset) + sizeof(struct smb_acl) + nt_size >

		    pntsd_alloc_size) {

			rc = -EINVAL;

			kfree(pntsd);

			goto free_aces_base;

		}



		if (pntsd->osidoffset) {

			struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd +

					le32_to_cpu(pntsd->osidoffset));