kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/fs/ksmbd
History
Kuan-Ting Chen 7cf3bf3cc0 ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate 
[ Upstream commit d738950f11 ]

Check request_buf length first to avoid out-of-bounds read by
req->DialectCount.

[ 3350.990282] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x35d7/0x3e60
[ 3350.990282] Read of size 2 at addr ffff88810ad61346 by task kworker/5:0/276
[ 3351.000406] Workqueue: ksmbd-io handle_ksmbd_work
[ 3351.003499] Call Trace:
[ 3351.006473]  <TASK>
[ 3351.006473]  dump_stack_lvl+0x8d/0xe0
[ 3351.006473]  print_report+0xcc/0x620
[ 3351.006473]  kasan_report+0x92/0xc0
[ 3351.006473]  smb2_handle_negotiate+0x35d7/0x3e60
[ 3351.014760]  ksmbd_smb_negotiate_common+0x7a7/0xf00
[ 3351.014760]  handle_ksmbd_work+0x3f7/0x12d0
[ 3351.014760]  process_one_work+0xa85/0x1780

Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-06-21 15:59:12 +02:00
..
mgmt ksmbd: fix racy issue while destroying session on multichannel 2023-05-17 11:50:28 +02:00
asn1.c ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
asn1.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
auth.c ksmbd: fix deadlock in ksmbd_find_crypto_ctx() 2023-05-17 11:50:29 +02:00
auth.h ksmbd: fix racy issue while destroying session on multichannel 2023-05-17 11:50:28 +02:00
connection.c ksmbd: allocate one more byte for implied bcc[0] 2023-05-24 17:36:54 +01:00
connection.h ksmbd: fix racy issue while destroying session on multichannel 2023-05-17 11:50:28 +02:00
crypto_ctx.c ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
crypto_ctx.h ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
glob.h ksmbd: fix version mismatch with out of tree 2021-10-07 10:18:34 -05:00
Kconfig ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION 2021-11-18 19:16:07 +01:00
ksmbd_netlink.h ksmbd: add max connections parameter 2023-02-01 08:27:24 +01:00
ksmbd_spnego_negtokeninit.asn1 ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
ksmbd_spnego_negtokentarg.asn1 ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
ksmbd_work.c ksmbd: reorder and document on-disk and netlink structures in headers 2021-06-30 14:47:24 +09:00
ksmbd_work.h ksmbd: change data type of volatile/persistent id to u64 2021-07-09 08:23:16 +09:00
Makefile ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
misc.c ksmbd: missing check for NULL in convert_to_nt_pathname() 2021-09-30 20:00:05 -05:00
misc.h ksmbd: use LOOKUP_BENEATH to prevent the out of share access 2021-09-24 21:25:23 -05:00
ndr.c ksmbd: downgrade ndr version error message to debug 2023-02-01 08:27:24 +01:00
ndr.h ksmbd: add user namespace support 2021-07-02 16:27:10 +09:00
nterr.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
ntlmssp.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
oplock.c ksmbd: fix global-out-of-bounds in smb2_find_context_vals 2023-05-24 17:36:54 +01:00
oplock.h ksmbd: fix global-out-of-bounds in smb2_find_context_vals 2023-05-24 17:36:54 +01:00
server.c ksmbd: call rcu_barrier() in ksmbd_server_exit() 2023-05-11 23:00:18 +09:00
server.h ksmbd: add max connections parameter 2023-02-01 08:27:24 +01:00
smb2misc.c ksmbd: smb2: Allow messages padded to 8byte boundary 2023-05-24 17:36:54 +01:00
smb2ops.c ksmbd: add support for smb2 max credit parameter 2022-01-27 11:02:53 +01:00
smb2pdu.c ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate 2023-06-21 15:59:12 +02:00
smb2pdu.h ksmbd: limit pdu length size according to connection status 2023-02-01 08:27:24 +01:00
smb_common.c ksmbd: return unsupported error on smb1 mount 2023-03-30 12:47:58 +02:00
smb_common.h ksmbd: fix racy issue while destroying session on multichannel 2023-05-17 11:50:28 +02:00
smbacl.c ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-21 15:17:48 +02:00
smbacl.h ksmbd: fix heap-based overflow in set_ntacl_dacl() 2022-08-21 15:17:48 +02:00
smbfsctl.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
smbstatus.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
transport_ipc.c ksmbd: add max connections parameter 2023-02-01 08:27:24 +01:00
transport_ipc.h ksmbd: throttle session setup failures to avoid dictionary attacks 2021-10-20 00:07:10 -05:00
transport_rdma.c ksmbd: don't terminate inactive sessions after a few seconds 2023-04-05 11:24:52 +02:00
transport_rdma.h ksmbd: add smbd max io size parameter 2023-02-01 08:27:24 +01:00
transport_tcp.c ksmbd: don't terminate inactive sessions after a few seconds 2023-04-05 11:24:52 +02:00
transport_tcp.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
unicode.c ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
unicode.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
uniupr.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
vfs.c ksmbd: fix racy issue while destroying session on multichannel 2023-05-17 11:50:28 +02:00
vfs.h ksmbd: don't align last entry offset in smb2 query directory 2022-02-23 12:03:18 +01:00
vfs_cache.c ksmbd: fix racy issue while destroying session on multichannel 2023-05-17 11:50:28 +02:00
vfs_cache.h ksmbd: remove unused ksmbd_file_table_flush function 2021-09-03 23:29:45 -05:00
xattr.h ksmbd: reorder and document on-disk and netlink structures in headers 2021-06-30 14:47:24 +09:00