ksmbd: fix null pointer dereference in alloc_preauth_hash()

Browse source

commit c8b5b7c5da upstream.

The Client send malformed smb2 negotiate request. ksmbd return error
response. Subsequently, the client can send smb2 session setup even
thought conn->preauth_info is not allocated.
This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore
session setup request if smb2 negotiate phase is not complete.

Cc: stable@vger.kernel.org
Tested-by: Steve French <stfrench@microsoft.com>
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-26505
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Namjae Jeon 2025-04-02 09:11:23 +09:00 • committed by Greg Kroah-Hartman

parent 56de7778a4

commit ca8bed31ed

3 changed files with 24 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

fs/smb/server/connection.h

View file

4

fs/smb/server/mgmt/user_session.c

View file

14

fs/smb/server/smb2pdu.c

View file