From patchwork Wed Oct 19 08:21:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 4514 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp203109wrs; Wed, 19 Oct 2022 01:42:14 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7ERqPT9+Pn+b8FalByK9HdSU6i8eAWDyFA5E9Aorr5M9uNjHZSOqVtjlucYueyo0n3WN7r X-Received: by 2002:a17:906:fe45:b0:791:9624:9ea5 with SMTP id wz5-20020a170906fe4500b0079196249ea5mr5888108ejb.282.1666168933827; Wed, 19 Oct 2022 01:42:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666168933; cv=none; d=google.com; s=arc-20160816; b=HXOi5QWQ95flDksJ/wnbEAI4ZytLWzMNWCmjizn6EyhhcmF/qXvUqjhIxLH/UMlw6o 2l98v8nBRX57VJvkJHueFVWo22MATS7ejbtc3BM8a9mVT55DeEPvA9LK3gFJNwTe9bn8 lDROABIT1j/LSG76H1XuCYMJTaPptXNItd2ztqm8EoS0ass5dcsHOgOQ8HDOx1yaNjGh GzIAKkFwgb40JdY9gq40iJvH2nIwAfrhxqaeUsWwOU99y//Rko/CL2lWrZwT/hIstVCA ZyX108n10/pktxojPtUdIiz1xXTMMwGCk4QJTzDdsydiFWGjn0IZfUM7b4NOrclxOshk U4Uw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=t9y4H2yG4aOtEDorIYtpQ6lXI2V0CQR9JjsfnIa4q5A=; b=ttYR67if96xZ417TD/9WzhPq5jaosB3dWiO2i+yRDnw+TR6ClXX0VCOnOjWQTP5C69 O2rRuQfkUOkd7LJwaHIiISKxEjxEGa55XKxV+WLQMvdtmGPxj4otsZKJ+mWy69moiI27 7sbJdzPUqaJRb44Bcet9LiCNAnsEaHC8R7GxpDgzOw7IE5fRT8msBEcdIkv1sBmLrJh8 f7wp/aBUbFEpI8iimNhTLEPn98DqgRgNGgaFVfIQrK6Q+jtRYzsFJU7YI2BAlhDJ9PQx UChunxbrCYxVeAN10aMgtGYrXccB7Ih64vom5B4QYt7Fpcm/r+lyjWIno/OnbqCwINv/ eOjA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=xBdwLJ49; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id hp6-20020a1709073e0600b0077ea290986fsi16227089ejc.584.2022.10.19.01.41.48; Wed, 19 Oct 2022 01:42:13 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=xBdwLJ49; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230483AbiJSIlD (ORCPT + 99 others); Wed, 19 Oct 2022 04:41:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55856 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230252AbiJSIjv (ORCPT ); Wed, 19 Oct 2022 04:39:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A0A98110C; Wed, 19 Oct 2022 01:38:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 263B9B821CD; Wed, 19 Oct 2022 08:38:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11599C433D6; Wed, 19 Oct 2022 08:38:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666168694; bh=ueD2SFqWj/bYjwtd+JoqGKckBkUCZOJQi3XXO3Pu9Fk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xBdwLJ4986qjZT90lZcH9anBbSifyYFcZkd+HKjXYSXMcR4lR69B5o+73GE3cXq22 VpLkWp3kaNWiAgpSCB6M1fzZjSxosnK8lQ3LSHWd2Fpu1yfOya6AEF3R3ZzdcYJIRn xdawRpa6Rz+zfnsCnszzR4tgjgmluFEYpRUkIKes= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhang Xiaoxu , "Paulo Alcantara (SUSE)" , Tom Talpey , Steve French Subject: [PATCH 6.0 023/862] cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message Date: Wed, 19 Oct 2022 10:21:50 +0200 Message-Id: <20221019083251.029839151@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747104755935823557?= X-GMAIL-MSGID: =?utf-8?q?1747104755935823557?= From: Zhang Xiaoxu commit e98ecc6e94f4e6d21c06660b0f336df02836694f upstream. Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") extend the dialects from 3 to 4, but forget to decrease the extended length when specific the dialect, then the message length is larger than expected. This maybe leak some info through network because not initialize the message body. After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is reduced from 28 bytes to 26 bytes. Fixes: d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") Signed-off-by: Zhang Xiaoxu Cc: Acked-by: Paulo Alcantara (SUSE) Reviewed-by: Tom Talpey Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman --- fs/cifs/smb2pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -1169,9 +1169,9 @@ int smb3_validate_negotiate(const unsign pneg_inbuf->Dialects[0] = cpu_to_le16(server->vals->protocol_id); pneg_inbuf->DialectCount = cpu_to_le16(1); - /* structure is big enough for 3 dialects, sending only 1 */ + /* structure is big enough for 4 dialects, sending only 1 */ inbuflen = sizeof(*pneg_inbuf) - - sizeof(pneg_inbuf->Dialects[0]) * 2; + sizeof(pneg_inbuf->Dialects[0]) * 3; } rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,