Lin Ma ebeae8adf8 ksmbd: fix global oob in ksmbd_nl_policy ... Similar to a reported issue (check the commit b33fb5b801 ("net: qualcomm: rmnet: fix global oob in rmnet_policy"), my local fuzzer finds another global out-of-bounds read for policy ksmbd_nl_policy. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff8f24b100 by task syz-executor.1/62810 CPU: 0 PID: 62810 Comm: syz-executor.1 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 __nlmsg_parse include/net/netlink.h:748 [inline] genl_family_rcv_msg_attrs_parse.constprop.0+0x1b0/0x290 net/netlink/genetlink.c:565 genl_family_rcv_msg_doit+0xda/0x330 net/netlink/genetlink.c:734 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x441/0x780 net/netlink/genetlink.c:850 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdd66a8f359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdd65e00168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdd66bbcf80 RCX: 00007fdd66a8f359 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000003 RBP: 00007fdd66ada493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc84b81aff R14: 00007fdd65e00300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: ksmbd_nl_policy+0x100/0xa80 The buggy address belongs to the physical page: page:0000000034f47940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ccc4b flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00073312c8 ffffea00073312c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff8f24b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff8f24b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff8f24b100: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 07 f9 ^ ffffffff8f24b180: f9 f9 f9 f9 00 05 f9 f9 f9 f9 f9 f9 00 00 00 05 ffffffff8f24b200: f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9 00 00 04 f9 ================================================================== To fix it, add a placeholder named __KSMBD_EVENT_MAX and let KSMBD_EVENT_MAX to be its original value - 1 according to what other netlink families do. Also change two sites that refer the KSMBD_EVENT_MAX to correct value. Cc: stable@vger.kernel.org Fixes: 0626e6641f ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Lin Ma <linma@zju.edu.cn> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>		2024-01-25 00:16:54 -06:00
..
9p	9p: Use length of data written to the server in preference to error	2024-01-04 13:15:31 +00:00
adfs	adfs: remove writepage implementation	2023-12-29 11:58:33 -08:00
affs	affs: d_obtain_alias(ERR_PTR(...)) will do the right thing	2023-12-21 12:51:02 -05:00
afs	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
autofs	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
bcachefs	More bcachefs updates for 6.7-rc1	2024-01-21 14:01:12 -08:00
befs	befs: d_obtain_alias(ERR_PTR(...)) will do the right thing	2023-12-21 12:51:02 -05:00
bfs	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
btrfs	for-6.8/block-2024-01-08	2024-01-11 13:58:04 -08:00
cachefiles	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
ceph	Assorted CephFS fixes and cleanups with nothing standing out.	2024-01-19 09:58:55 -08:00
coda	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
configfs
cramfs	vfs-6.7.ctime	2023-10-30 09:47:13 -10:00
crypto	fscrypt: document that CephFS supports fscrypt now	2023-12-26 22:55:42 -06:00
debugfs	Merge branches 'acpi-pm', 'acpi-video', 'acpi-apei' and 'acpi-extlog'	2024-01-04 13:19:40 +01:00
devpts	fs: Remove the now superfluous sentinel elements from ctl_table array	2023-12-28 04:57:57 -08:00
dlm	dlm: update format header reflect current format	2023-12-20 15:36:48 -06:00
ecryptfs	fix directory locking scheme on rename	2024-01-11 20:00:22 -08:00
efivarfs	efivarfs: automatically update super block flag	2023-12-11 11:19:18 +01:00
efs	vfs-6.7.fsid	2023-11-07 12:11:26 -08:00
erofs	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
exfat	exfat: do not zero the extended part	2024-01-08 21:57:22 +09:00
exportfs	fs: fix build error with CONFIG_EXPORTFS=m or not defined	2023-10-28 16:16:19 +02:00
ext2	fix directory locking scheme on rename	2024-01-11 20:00:22 -08:00
ext4	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
f2fs	f2fs: fix double free of f2fs_sb_info	2024-01-12 18:55:09 -08:00
fat	vfs-6.7.fsid	2023-11-07 12:11:26 -08:00
freevxfs	freevxfs: lookup: fix function params kernel-doc	2023-12-20 15:02:58 -08:00
fuse	vfs-6.8.rw	2024-01-08 11:11:51 -08:00
gfs2	dlm for 6.8	2024-01-10 10:17:23 -08:00
hfs	hfs: really remove hfs_writepage	2023-12-29 11:58:34 -08:00
hfsplus	Many singleton patches against the MM code. The patch series which	2024-01-09 11:18:47 -08:00
hostfs	hostfs: use d_splice_alias() calling conventions to simplify failure exits	2023-12-21 12:51:00 -05:00
hpfs
hugetlbfs	Many singleton patches against the MM code. The patch series which	2024-01-09 11:18:47 -08:00
iomap	mm: add folio_fill_tail() and use it in iomap	2023-12-10 16:51:36 -08:00
isofs
jbd2	jbd2: abort journal when detecting metadata writeback error of fs dev	2024-01-04 23:42:21 -05:00
jffs2	jffs2: mark __jffs2_dbg_superblock_counts() static	2023-12-10 17:21:43 -08:00
jfs	jfs: Add missing set_freezable() for freezable kthread	2024-01-02 11:06:52 -06:00
kernfs	Revert "kernfs: convert kernfs_idr_lock to an irq safe raw spinlock"	2024-01-11 11:51:27 +01:00
lockd	sysctl-6.8-rc1	2024-01-10 17:44:36 -08:00
minix	minixfs kmap_local_page() switchover and related fixes - very similar to sysv series.	2024-01-11 19:54:18 -08:00
netfs	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
nfs	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
nfs_common
nfsd	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
nilfs2	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
nls
notify	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
ntfs	sysctl-6.8-rc1	2024-01-10 17:44:36 -08:00
ntfs3	vfs-6.7.fsid	2023-11-07 12:11:26 -08:00
ocfs2	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
omfs
openpromfs
orangefs	orangefs: saner arguments passing in readdir guts	2023-12-21 12:53:36 -05:00
overlayfs	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
proc	17 hotfixes. 10 address post-6.7 issues and the other 7 are cc:stable.	2024-01-17 09:31:36 -08:00
pstore	pstore: inode: Use cleanup.h for struct pstore_private	2023-12-08 14:15:44 -08:00
qnx4	qnx4: Use get_directory_fname() in qnx4_match()	2023-12-13 11:19:18 -08:00
qnx6
quota	sysctl-6.8-rc1	2024-01-10 17:44:36 -08:00
ramfs	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
reiserfs	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
romfs	vfs-6.7.ctime	2023-10-30 09:47:13 -10:00
smb	ksmbd: fix global oob in ksmbd_nl_policy	2024-01-25 00:16:54 -06:00
squashfs	Squashfs: fix variable overflow triggered by sysbot	2023-12-10 17:21:26 -08:00
sysfs	fs/sysfs/dir.c : Fix typo in comment	2023-12-07 11:35:23 +09:00
sysv	sysv: remove writepage implementation	2023-12-29 11:58:35 -08:00
tracefs	eventfs: Use kcalloc() instead of kzalloc()	2024-01-16 17:52:33 -05:00
ubifs	ubifs: fix kernel-doc warnings	2024-01-06 23:49:50 +01:00
udf	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
ufs	Many singleton patches against the MM code. The patch series which	2024-01-09 11:18:47 -08:00
unicode
vboxsf	fs: vboxsf: fix a kernel-doc warning	2023-12-08 15:32:31 -07:00
verity	Networking changes for 6.8.	2024-01-11 10:07:29 -08:00
xfs	Bug fixes for 6.8:	2024-01-19 09:57:08 -08:00
zonefs	misc cleanups (the part that hadn't been picked by individual fs trees)	2024-01-11 20:23:50 -08:00
aio.c	sysctl-6.8-rc1	2024-01-10 17:44:36 -08:00
anon_inodes.c	Merge branch 'kvm-guestmemfd' into HEAD	2023-11-14 08:31:31 -05:00
attr.c	fs: fix doc comment typo fs tree wide	2023-12-21 13:17:54 +01:00
backing-file.c	fs: factor out backing_file_mmap() helper	2023-12-23 16:35:09 +02:00
bad_inode.c
binfmt_elf_fdpic.c	execve updates for v6.7-rc1	2023-10-30 19:28:19 -10:00
binfmt_elf_test.c
binfmt_elf.c
binfmt_flat.c
binfmt_misc.c	execve updates for v6.7-rc1	2023-10-30 19:28:19 -10:00
binfmt_script.c
buffer.c	Many singleton patches against the MM code. The patch series which	2024-01-09 11:18:47 -08:00
char_dev.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
compat_binfmt_elf.c
coredump.c	fs: Remove the now superfluous sentinel elements from ctl_table array	2023-12-28 04:57:57 -08:00
d_path.c
dax.c	fs : Fix warning using plain integer as NULL	2023-11-18 15:00:01 +01:00
dcache.c	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
direct-io.c	fs : Fix warning using plain integer as NULL	2023-11-18 15:00:01 +01:00
drop_caches.c
eventfd.c	eventfd: Remove usage of the deprecated ida_simple_xx() API	2023-12-12 14:24:55 +01:00
eventpoll.c	fs: Remove the now superfluous sentinel elements from ctl_table array	2023-12-28 04:57:57 -08:00
exec.c	execve: open the executable file before doing anything else	2024-01-20 12:15:43 -08:00
fcntl.c
fhandle.c	exportfs: add helpers to check if filesystem can encode/decode file handles	2023-10-24 17:57:45 +02:00
file_table.c	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
file.c	file: remove __receive_fd()	2023-12-12 14:24:14 +01:00
filesystems.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	netfs: Move pinning-for-writeback from fscache to netfs	2023-12-24 15:08:49 +00:00
fsopen.c
init.c
inode.c	fix directory locking scheme on rename	2024-01-11 20:00:22 -08:00
internal.h	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
ioctl.c	lsm: new security_file_ioctl_compat() hook	2023-12-24 15:48:03 -05:00
Kconfig	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
Kconfig.binfmt
kernel_read_file.c
libfs.c	dcache stuff for this cycle	2024-01-11 20:11:35 -08:00
locks.c	fs: Remove the now superfluous sentinel elements from ctl_table array	2023-12-28 04:57:57 -08:00
Makefile	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
mbcache.c
mnt_idmapping.c	mnt_idmapping: decouple from namespaces	2023-11-28 14:08:47 +01:00
mount.h	mounts: keep list of mounts in an rbtree	2023-11-18 14:56:16 +01:00
mpage.c	fs: convert block_write_full_page to block_write_full_folio	2023-12-29 11:58:35 -08:00
namei.c	fix buggered locking in bch2_ioctl_subvolume_destroy()	2024-01-12 18:04:01 -08:00
namespace.c	fs: rework listmount() implementation	2024-01-13 13:06:25 +01:00
nsfs.c	nsfs: use d_make_root()	2023-11-25 02:49:43 -05:00
open.c	vfs-6.8.rw	2024-01-08 11:11:51 -08:00
pipe.c	sysctl-6.8-rc1	2024-01-10 17:44:36 -08:00
pnode.c	mounts: keep list of mounts in an rbtree	2023-11-18 14:56:16 +01:00
pnode.h
posix_acl.c	fs: fix doc comment typo fs tree wide	2023-12-21 13:17:54 +01:00
proc_namespace.c	namespace: extract show_path() helper	2023-11-18 14:56:16 +01:00
read_write.c	fsnotify: optionally pass access range in file permission hooks	2023-12-12 16:20:02 +01:00
readdir.c	fsnotify: optionally pass access range in file permission hooks	2023-12-12 16:20:02 +01:00
remap_range.c	fsnotify: optionally pass access range in file permission hooks	2023-12-12 16:20:02 +01:00
select.c
seq_file.c
signalfd.c
splice.c	fs: use splice_copy_file_range() inline helper	2023-12-12 16:20:02 +01:00
stack.c
stat.c	vfs-6.8.mount	2024-01-08 10:57:34 -08:00
statfs.c
super.c	fscrypt updates for 6.8	2024-01-10 10:24:49 -08:00
sync.c
sysctls.c	fs: Remove the now superfluous sentinel elements from ctl_table array	2023-12-28 04:57:57 -08:00
timerfd.c
userfaultfd.c	Generic:	2024-01-17 13:03:37 -08:00
utimes.c
xattr.c