ksmbd: replace one-element array with flex-array member in struct smb2_ea_info

BugLink: https://bugs.launchpad.net/bugs/2039884
commit 0ba5439d9afa2722e7728df56f272c89987540a4 upstream.

UBSAN complains about out-of-bounds array indexes on 1-element arrays in
struct smb2_ea_info.

UBSAN: array-index-out-of-bounds in fs/smb/server/smb2pdu.c:4335:15
index 1 is out of range for type 'char [1]'
CPU: 1 PID: 354 Comm: kworker/1:4 Not tainted 6.5.0-rc4 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
Reference Platform, BIOS 6.00 07/22/2020
Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
Call Trace:
 <TASK>
 __dump_stack linux/lib/dump_stack.c:88
 dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
 dump_stack+0x10/0x20 linux/lib/dump_stack.c:113
 ubsan_epilogue linux/lib/ubsan.c:217
 __ubsan_handle_out_of_bounds+0xc6/0x110 linux/lib/ubsan.c:348
 smb2_get_ea linux/fs/smb/server/smb2pdu.c:4335
 smb2_get_info_file linux/fs/smb/server/smb2pdu.c:4900
 smb2_query_info+0x63ae/0x6b20 linux/fs/smb/server/smb2pdu.c:5275
 __process_request linux/fs/smb/server/server.c:145
 __handle_ksmbd_work linux/fs/smb/server/server.c:213
 handle_ksmbd_work+0x348/0x10b0 linux/fs/smb/server/server.c:266
 process_one_work+0x85a/0x1500 linux/kernel/workqueue.c:2597
 worker_thread+0xf3/0x13a0 linux/kernel/workqueue.c:2748
 kthread+0x2b7/0x390 linux/kernel/kthread.c:389
 ret_from_fork+0x44/0x90 linux/arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 linux/arch/x86/entry/entry_64.S:304
 </TASK>

Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index a5287ea48e012ab3039f0d297a07edda4fde3653..b10c9e55ce28d2a717232b4ad3bd974c0cd35668 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4324,7 +4324,7 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
                if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
                        name_len -= XATTR_USER_PREFIX_LEN;
 
-               ptr = (char *)(&eainfo->name + name_len + 1);
+               ptr = eainfo->name + name_len + 1;
                buf_free_len -= (offsetof(struct smb2_ea_info, name) +
                                name_len + 1);
                /* bailout if xattr can't fit in buf_free_len */

diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index df05c9b2504d4060b13e9b86f59edc754849a5e7..f13bd65993ccc8b45aae35c2abcfaa408ef39257 100644 (file)
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -410,7 +410,7 @@ struct smb2_ea_info {
        __u8   Flags;
        __u8   EaNameLength;
        __le16 EaValueLength;
-       char name[1];
+       char name[];
        /* optionally followed by value */
 } __packed; /* level 15 Query */