On an encrypted ("seal") mount, SMB2_ioctl_init() keeps the IOCTL input in a separate iov (iov[1]); iov[0] is a 448-byte buffer from cifs_small_buf_get(). When such an IOCTL is not the last request of a compound, smb2_set_next_command() pads it for alignment by copying the whole request into iov[0]. A large enough input overflows that 448-byte buffer and corrupts the slab; the copy also sets rq_nvec to 1, so the input buffer is leaked too. An unprivileged user can trigger it by creating a symlink with a long target on such a mount: the native symlink is sent as FSCTL_SET_REPARSE_POINT + QUERY_INFO + CLOSE in one compound, so the IOCTL is not the last request. With slub_debug red zones on the cifs_small_rq cache, the overflow is caught on the next allocation from that cache in the same compound (the 0x61 bytes are the 'a' characters of the symlink target): BUG cifs_small_rq (Not tainted): Object corrupt [Left Redzone overwritten] 0xffff8a59c7790500-0xffff8a59c779053f First byte 0x61 instead of 0xbb Call Trace: check_object+0x1a8/0x350 alloc_debug_processing+0xab/0x110 ___slab_alloc+0x7e/0x2f0 kmem_cache_alloc_noprof+0x28d/0x4b0 mempool_alloc_slab+0x16/0x30 cifs_small_buf_get+0x1a/0x30 [cifs] SMB2_close_init+0x8a/0x100 [cifs] smb2_compound_op+0x2571/0x2b50 [cifs] smb2_create_reparse_inode+0x27e/0x490 [cifs] mknod_nfs+0x1ce/0x2e0 [cifs] create_reparse_symlink+0x119/0x180 [cifs] cifs_symlink+0x19f/0x8e0 [cifs] vfs_symlink+0xa3/0x1b0 __x64_sys_symlink+0x41/0x70 Pad the input to a multiple of 8 bytes when encryption is required. The request is then already aligned and smb2_set_next_command() no longer copies it; InputCount still carries the real length. Fixes: 90f7c100d2dd ("smb: client: fix compound alignment with encryption") Cc: stable@vger.kernel.org Signed-off-by: Andrey Misiurov --- fs/smb/client/smb2pdu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index b140ec0a71a8..71d9b698c208 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -3432,6 +3432,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, unsigned int total_len; int rc; char *in_data_buf; + u32 in_buf_len = indatalen; rc = smb2_ioctl_req_init(opcode, tcon, server, (void **) &req, &total_len); @@ -3439,15 +3440,18 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, return rc; if (indatalen) { + if (smb3_encryption_required(tcon)) + in_buf_len = ALIGN(indatalen, 8); /* * indatalen is usually small at a couple of bytes max, so * just allocate through generic pool */ - in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); + in_data_buf = kzalloc(in_buf_len, GFP_NOFS); if (!in_data_buf) { cifs_small_buf_release(req); return -ENOMEM; } + memcpy(in_data_buf, in_data, indatalen); } req->CtlCode = cpu_to_le32(opcode); @@ -3471,7 +3482,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, rqst->rq_nvec = 2; iov[0].iov_len = total_len - 1; iov[1].iov_base = in_data_buf; - iov[1].iov_len = indatalen; + iov[1].iov_len = in_buf_len; } else { rqst->rq_nvec = 1; iov[0].iov_len = total_len; -- 2.47.3