| Message ID | 20230305123443.21509-2-linkinjeon@kernel.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/2] ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA | expand |
On (23/03/05 21:34), Namjae Jeon wrote: > +++ b/fs/ksmbd/smb2pdu.c > @@ -7457,6 +7457,11 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id, > start = le64_to_cpu(qar_req->file_offset); > length = le64_to_cpu(qar_req->length); > > + if (start < 0 || length < 0) { > + ksmbd_fd_put(work, fp); > + return -EINVAL; > + } Can we do sanity checking before we ksmbd_lookup_fd_fast()?
2023-03-07 13:09 GMT+09:00, Sergey Senozhatsky <senozhatsky@chromium.org>: > On (23/03/05 21:34), Namjae Jeon wrote: >> +++ b/fs/ksmbd/smb2pdu.c >> @@ -7457,6 +7457,11 @@ static int fsctl_query_allocated_ranges(struct >> ksmbd_work *work, u64 id, >> start = le64_to_cpu(qar_req->file_offset); >> length = le64_to_cpu(qar_req->length); >> >> + if (start < 0 || length < 0) { >> + ksmbd_fd_put(work, fp); >> + return -EINVAL; >> + } > > Can we do sanity checking before we ksmbd_lookup_fd_fast()? We can:), will update it on v2. Thanks! >
diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index b7a420e0fcc4..4af4230ab50b 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -7457,6 +7457,11 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id, start = le64_to_cpu(qar_req->file_offset); length = le64_to_cpu(qar_req->length); + if (start < 0 || length < 0) { + ksmbd_fd_put(work, fp); + return -EINVAL; + } + ret = ksmbd_vfs_fqar_lseek(fp, start, length, qar_rsp, in_count, out_count); if (ret && ret != -E2BIG)
Smatch static checker warning: fs/ksmbd/vfs.c:1040 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'length' fs/ksmbd/vfs.c:1041 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'start' Fix unexpected result that could caused from negative start and length. Fixes: f44158485826 ("cifsd: add file operations") Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+)