[PATCH 3.12 078/100] CIFS: Fix a possible invalid memory access in smb2_query_symlink()

[Jiri Slaby]

From: Pavel Shilovsky <pshilov...@samba.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 7893242e2465aea6f2cbc2639da8fa5ce96e8cc2 upstream.

During following a symbolic link we received err_buf from SMB2_open().
While the validity of SMB2 error response is checked previously
in smb2_check_message() a symbolic link payload is not checked at all.
Fix it by adding such checks.

Cc: Dan Carpenter <dan.carpen...@oracle.com>
Signed-off-by: Pavel Shilovsky <pshilov...@samba.org>
Signed-off-by: Steve French <smfre...@gmail.com>
Signed-off-by: Jiri Slaby <jsl...@suse.cz>
---
 fs/cifs/smb2ops.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 57519567b2ac..a3a7a52aef04 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -598,6 +598,9 @@ smb2_new_lease_key(struct cifs_fid *fid)
        get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);
 }
 
+#define SMB2_SYMLINK_STRUCT_SIZE \
+       (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp))
+
 static int
 smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
                   const char *full_path, char **target_path,
@@ -610,7 +613,10 @@ smb2_query_symlink(const unsigned int xid, struct 
cifs_tcon *tcon,
        struct cifs_fid fid;
        struct smb2_err_rsp *err_buf = NULL;
        struct smb2_symlink_err_rsp *symlink;
-       unsigned int sub_len, sub_offset;
+       unsigned int sub_len;
+       unsigned int sub_offset;
+       unsigned int print_len;
+       unsigned int print_offset;
 
        cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path);
 
@@ -631,11 +637,33 @@ smb2_query_symlink(const unsigned int xid, struct 
cifs_tcon *tcon,
                kfree(utf16_path);
                return -ENOENT;
        }
+
+       if (le32_to_cpu(err_buf->ByteCount) < sizeof(struct 
smb2_symlink_err_rsp) ||
+           get_rfc1002_length(err_buf) + 4 < SMB2_SYMLINK_STRUCT_SIZE) {
+               kfree(utf16_path);
+               return -ENOENT;
+       }
+
        /* open must fail on symlink - reset rc */
        rc = 0;
        symlink = (struct smb2_symlink_err_rsp *)err_buf->ErrorData;
        sub_len = le16_to_cpu(symlink->SubstituteNameLength);
        sub_offset = le16_to_cpu(symlink->SubstituteNameOffset);
+       print_len = le16_to_cpu(symlink->PrintNameLength);
+       print_offset = le16_to_cpu(symlink->PrintNameOffset);
+
+       if (get_rfc1002_length(err_buf) + 4 <
+                       SMB2_SYMLINK_STRUCT_SIZE + sub_offset + sub_len) {
+               kfree(utf16_path);
+               return -ENOENT;
+       }
+
+       if (get_rfc1002_length(err_buf) + 4 <
+                       SMB2_SYMLINK_STRUCT_SIZE + print_offset + print_len) {
+               kfree(utf16_path);
+               return -ENOENT;
+       }
+
        *target_path = cifs_strndup_from_utf16(
                                (char *)symlink->PathBuffer + sub_offset,
                                sub_len, true, cifs_sb->local_nls);
-- 
2.9.3