Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-02 09:01:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
f0a96d1aaf
linux/fs/ksmbd
History
Chih-Yen Chang f0a96d1aaf ksmbd: fix wrong UserName check in session_user 
The offset of UserName is related to the address of security
buffer. To ensure the validaty of UserName, we need to compare name_off
+ name_len with secbuf_len instead of auth_msg_len.

[   27.096243] ==================================================================
[   27.096890] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x188/0x350
[   27.097609] Read of size 2 at addr ffff888005e3b542 by task kworker/0:0/7
...
[   27.099950] Call Trace:
[   27.100194]  <TASK>
[   27.100397]  dump_stack_lvl+0x33/0x50
[   27.100752]  print_report+0xcc/0x620
[   27.102305]  kasan_report+0xae/0xe0
[   27.103072]  kasan_check_range+0x35/0x1b0
[   27.103757]  smb_strndup_from_utf16+0x188/0x350
[   27.105474]  smb2_sess_setup+0xaf8/0x19c0
[   27.107935]  handle_ksmbd_work+0x274/0x810
[   27.108315]  process_one_work+0x419/0x760
[   27.108689]  worker_thread+0x2a2/0x6f0
[   27.109385]  kthread+0x160/0x190
[   27.110129]  ret_from_fork+0x1f/0x30
[   27.110454]  </TASK>

Cc: stable@vger.kernel.org
Signed-off-by: Chih-Yen Chang <cc85nod@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2023-05-16 10:26:14 -05:00
..
mgmt ksmbd: fix racy issue under cocurrent smb2 tree disconnect 2023-05-03 23:03:02 -05:00
asn1.c ksmbd: Remove duplicated codes 2023-01-30 20:49:30 -06:00
asn1.h
auth.c ksmbd: fix deadlock in ksmbd_find_crypto_ctx() 2023-05-03 23:03:01 -05:00
auth.h ksmbd: fix encryption failure issue for session logoff response 2022-10-05 01:15:44 -05:00
connection.c ksmbd: fix racy issue from smb2 close and logoff with multichannel 2023-05-03 23:03:02 -05:00
connection.h ksmbd: fix racy issue from smb2 close and logoff with multichannel 2023-05-03 23:03:02 -05:00
crypto_ctx.c ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
crypto_ctx.h ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
glob.h ksmbd: fix version mismatch with out of tree 2021-10-07 10:18:34 -05:00
Kconfig ksmbd: update Kconfig to note Kerberos support and fix indentation 2023-01-30 20:49:30 -06:00
ksmbd_netlink.h ksmbd: add max connections parameter 2023-01-20 15:27:48 -06:00
ksmbd_spnego_negtokeninit.asn1
ksmbd_spnego_negtokentarg.asn1
ksmbd_work.c ksmbd: Remove redundant 'flush_workqueue()' calls 2021-11-06 23:52:06 -05:00
ksmbd_work.h ksmbd: delete asynchronous work from list 2023-04-02 23:08:52 -05:00
Makefile
misc.c ksmbd: validate share name from share config response 2022-10-05 01:15:44 -05:00
misc.h ksmbd: validate share name from share config response 2022-10-05 01:15:44 -05:00
ndr.c fs.idmapped.v6.3 2023-02-20 11:53:11 -08:00
ndr.h fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap 2023-01-19 09:24:29 +01:00
nterr.h
ntlmssp.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00
oplock.c ksmbd: fix global-out-of-bounds in smb2_find_context_vals 2023-05-16 10:26:14 -05:00
oplock.h ksmbd: fix global-out-of-bounds in smb2_find_context_vals 2023-05-16 10:26:14 -05:00
server.c ksmbd: call rcu_barrier() in ksmbd_server_exit() 2023-05-03 23:03:02 -05:00
server.h ksmbd: add max connections parameter 2023-01-20 15:27:48 -06:00
smb2misc.c ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length 2023-02-15 00:04:38 -06:00
smb2ops.c smb3: Replace smb2pdu 1-element arrays with flex-arrays 2023-02-20 17:25:43 -06:00
smb2pdu.c ksmbd: fix wrong UserName check in session_user 2023-05-16 10:26:14 -05:00
smb2pdu.h 9 smb3 client fixes, mostly DFS or reconnect related 2023-05-07 10:46:21 -07:00
smb_common.c ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr 2023-04-02 23:08:56 -05:00
smb_common.h ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr 2023-04-02 23:08:56 -05:00
smbacl.c fs: port vfs{g,u}id helpers to mnt_idmap 2023-01-19 09:24:30 +01:00
smbacl.h fs: port vfs{g,u}id helpers to mnt_idmap 2023-01-19 09:24:30 +01:00
smbfsctl.h
smbstatus.h
transport_ipc.c ksmbd: add max connections parameter 2023-01-20 15:27:48 -06:00
transport_ipc.h ksmbd: throttle session setup failures to avoid dictionary attacks 2021-10-20 00:07:10 -05:00
transport_rdma.c ksmbd: don't terminate inactive sessions after a few seconds 2023-03-22 16:38:33 -05:00
transport_rdma.h ksmbd: fix wrong smbd max read/write size check 2022-05-21 15:01:43 -05:00
transport_tcp.c ksmbd: fix racy issue from session setup and logoff 2023-05-03 23:03:01 -05:00
transport_tcp.h
unicode.c ksmbd: remove unused is_char_allowed function 2023-03-25 14:54:06 -05:00
unicode.h ksmbd: casefold utf-8 share names and fix ascii lowercase conversion 2022-10-05 01:15:37 -05:00
uniupr.h
vfs_cache.c ksmbd: fix racy issue from using ->d_parent and ->d_name 2023-04-24 00:09:20 -05:00
vfs_cache.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
vfs.c ksmbd: fix racy issue from using ->d_parent and ->d_name 2023-04-24 00:09:20 -05:00
vfs.h ksmbd: fix racy issue from using ->d_parent and ->d_name 2023-04-24 00:09:20 -05:00
xattr.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00