From nobody Mon Apr 4 17:44:05 2022 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 329CC1A8B788 for ; Mon, 4 Apr 2022 17:44:06 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KXJ6s5hZ4z3J4h for ; Mon, 4 Apr 2022 17:44:05 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A413116A11 for ; Mon, 4 Apr 2022 17:44:05 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 234Hi50e065314 for ; Mon, 4 Apr 2022 17:44:05 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 234Hi5VZ065313 for bugs@FreeBSD.org; Mon, 4 Apr 2022 17:44:05 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 263043] malformed SMB reply can page-fault the kernel in smb_t2_placedata() Date: Mon, 04 Apr 2022 17:44:05 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: rtm@lcs.mit.edu X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1649094245; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TkS53sPigkZNJLsLkDpNOIEvA8XjZm9B/7yLnV8uKJQ=; b=vP1rSCSNPLaruYS2zM4i3zOMjAOwmT9VQbCc1ybPbXaTEb9duC60ZdDL0DAvpL9ZzhJFfU 8aYP5zTQdRfluDW/nffpfNI8W26izcZAB+36BILchbesxvjMObSsD0b95T6G6MbbdCMmD4 4ycmMwnKSTWuZL5AIORiahArmKp9Rr/KyKTQO4m/UYtx0pnFEJJxmPNCV2JDBI6pO+aUWa 9aLo/v+7WUycG3g+YG+wN830yzIVNxM4WfeEygmrnGHxvV7/MGraLUCFKxl5aTR0rBK3wd G9Bg2+OQ6fgmFKFuBhYOKHzHri9CwWFdvZGqumHdCa8pgPYtazZS1yS68YGcWA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1649094245; a=rsa-sha256; cv=none; b=XiXjYgnB1X5t2RR592txHAMKKLM0OTu54rMMd57hwqIRxe8KX9MBSQoXOq4zBJQ+UkECHG QA+tIUr9vTp+Xaf9wPVjv1BIDsnUjqaAJv6VVU0nW122D/FkdKQE0bkFAzqGNWfYnMoDlL 1VwP/gDPSTAEmWPrg5nQzPhMW4WnlmjfDICKXuB+0snQNjP0ANKYf3+9GWGNEhdnmR1j2V P//U9ysWA7gWf9iQThTrCUg8KvVZSN9NQhxgW6OGo8c7UdnTrgacwYP5q9HUJTb/DgU8tS rE1PjzHvTpTvNHTAEyKhE3nikM4lHm6QAPTU6SRU7m1Y2iuKAwrsl6bNrPkutQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D263043 Bug ID: 263043 Summary: malformed SMB reply can page-fault the kernel in smb_t2_placedata() Product: Base System Version: Unspecified Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu Created attachment 232940 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D232940&action= =3Dedit fake SMB server that provokes a page-fault in the kernel smb client's smb_t2_placedata() If an SMB reply message claims a tiny offset for the data, placing the data before the parameters, smb_t2_placedata() can page-fault on the zero return value from a failing m_split(). This can occur on both 13.0-RELEASE-p8 and a recent CURRENT. I've attached a demo that mounts a fake SMB server on /mnt; the server generates a bad SMB reply at one point. That reply has data offset=3D4 count=3D68, params offset=3D56 count=3D10. # uname -a FreeBSD xxx 13.0-RELEASE-p8 FreeBSD 13.0-RELEASE-p8 #0: Tue Mar 15 09:36:28= UTC 2022=20=20=20=20 root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC= =20 amd64 # cc saxs1.c # ./a.out ... client #18 89 client #19 89 Fatal trap 12: page fault while in kernel mode cpuid =3D 0; apic id =3D 00 fault virtual address =3D 0x18 fault code =3D supervisor write data, page not present instruction pointer =3D 0x20:0xffffffff8231aef4 stack pointer =3D 0x28:0xfffffe0063d87140 frame pointer =3D 0x28:0xfffffe0063d87250 code segment =3D base 0x0, limit 0xfffff, type 0x1b =3D DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags =3D interrupt enabled, resume, IOPL =3D 0 current process =3D 721 (a.out) trap number =3D 12 panic: page fault cpuid =3D 0 time =3D 1649089759 KDB: stack backtrace: #0 0xffffffff80c57525 at kdb_backtrace+0x65 #1 0xffffffff80c09f01 at vpanic+0x181 #2 0xffffffff80c09d73 at panic+0x43 #3 0xffffffff8108b1a7 at trap_fatal+0x387 #4 0xffffffff8108b1ff at trap_pfault+0x4f #5 0xffffffff8108a85d at trap+0x27d #6 0xffffffff81061d98 at calltrap+0x8 #7 0xffffffff82325189 at smbfs_findnext+0xa09 #8 0xffffffff82325453 at smbfs_smb_lookup+0xb3 #9 0xffffffff823219d7 at smbfs_getattr+0x67 #10 0xffffffff8231f3d0 at smbfs_node_alloc+0x270 #11 0xffffffff8231f0dc at smbfs_nget+0x6c #12 0xffffffff8232122b at smbfs_lookup+0x4eb #13 0xffffffff80cd776c at lookup+0x68c #14 0xffffffff80cd6a87 at namei+0x487 #15 0xffffffff80cf78ae at kern_renameat+0xee #16 0xffffffff8108baac at amd64_syscall+0x10c #17 0xffffffff810626be at fast_syscall_common+0xf8 --=20 You are receiving this mail because: You are the assignee for the bug.=