android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
ddca03d97d
android_kernel_samsung_sm8650/fs/ksmbd
History
Namjae Jeon a8334a0c53 ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr 
commit dc8289f912387c3bcfbc5d2db29c8947fa207c11 upstream.

When smb1 mount fails, KASAN detect slab-out-of-bounds in
init_smb2_rsp_hdr like the following one.
For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called.
The issue occurs while handling smb1 negotiate as smb2 server operations.
Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr,
allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that
smb2 server operation does not handle it.

[  411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is
not recommended unless required for access to very old servers
[  411.400452] CIFS: Attempting to mount \\192.168.45.139\homes
[  411.479312] ksmbd: init_smb2_rsp_hdr : 492
[  411.479323] ==================================================================
[  411.479327] BUG: KASAN: slab-out-of-bounds in
init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[  411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199

[  411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G
 OE      6.1.21 #3
[  411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8
Series/Z10PA-D8 Series, BIOS 3801 08/23/2019
[  411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
[  411.479425] Call Trace:
[  411.479428]  <TASK>
[  411.479432]  dump_stack_lvl+0x49/0x63
[  411.479444]  print_report+0x171/0x4a8
[  411.479452]  ? kasan_complete_mode_report_info+0x3c/0x200
[  411.479463]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[  411.479497]  kasan_report+0xb4/0x130
[  411.479503]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[  411.479537]  kasan_check_range+0x149/0x1e0
[  411.479543]  memcpy+0x24/0x70
[  411.479550]  init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd]
[  411.479585]  handle_ksmbd_work+0x109/0x760 [ksmbd]
[  411.479616]  ? _raw_spin_unlock_irqrestore+0x50/0x50
[  411.479624]  ? smb3_encrypt_resp+0x340/0x340 [ksmbd]
[  411.479656]  process_one_work+0x49c/0x790
[  411.479667]  worker_thread+0x2b1/0x6e0
[  411.479674]  ? process_one_work+0x790/0x790
[  411.479680]  kthread+0x177/0x1b0
[  411.479686]  ? kthread_complete_and_exit+0x30/0x30
[  411.479692]  ret_from_fork+0x22/0x30
[  411.479702]  </TASK>

Fixes: 39b291b86b59 ("ksmbd: return unsupported error on smb1 mount")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:55:29 +02:00
..
mgmt ksmbd: Fix resource leak in ksmbd_session_rpc_open() 2022-12-31 13:32:42 +01:00
asn1.c ksmbd: use oid registry functions to decode OIDs 2021-12-28 22:47:22 -06:00
asn1.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
auth.c ksmbd: fix wrong signingkey creation when encryption is AES256 2023-03-30 12:49:26 +02:00
auth.h ksmbd: fix encryption failure issue for session logoff response 2022-10-05 01:15:44 -05:00
connection.c ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN 2023-04-13 16:55:29 +02:00
connection.h ksmbd: don't terminate inactive sessions after a few seconds 2023-03-30 12:49:26 +02:00
crypto_ctx.c ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
crypto_ctx.h ksmbd: remove NTLMv1 authentication 2021-09-29 16:17:34 -05:00
glob.h ksmbd: fix version mismatch with out of tree 2021-10-07 10:18:34 -05:00
Kconfig ksmbd: remove md4 leftovers 2021-11-11 19:22:58 -06:00
ksmbd_netlink.h ksmbd: add max connections parameter 2023-02-01 08:34:37 +01:00
ksmbd_spnego_negtokeninit.asn1 ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
ksmbd_spnego_negtokentarg.asn1 ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
ksmbd_work.c ksmbd: Remove redundant 'flush_workqueue()' calls 2021-11-06 23:52:06 -05:00
ksmbd_work.h ksmbd: remove smb2_buf_length in smb2_hdr 2021-11-11 19:22:58 -06:00
Makefile ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
misc.c ksmbd: validate share name from share config response 2022-10-05 01:15:44 -05:00
misc.h ksmbd: validate share name from share config response 2022-10-05 01:15:44 -05:00
ndr.c ksmbd: downgrade ndr version error message to debug 2023-02-01 08:34:38 +01:00
ndr.h ksmbd: add user namespace support 2021-07-02 16:27:10 +09:00
nterr.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
ntlmssp.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00
oplock.c ksmbd: set file permission mode to match Samba server posix extension behavior 2022-10-05 01:15:44 -05:00
oplock.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
server.c ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr 2023-04-13 16:55:29 +02:00
server.h ksmbd: add max connections parameter 2023-02-01 08:34:37 +01:00
smb2misc.c ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length 2023-03-10 09:34:07 +01:00
smb2ops.c ksmbd: add support for smb2 max credit parameter 2022-01-10 12:44:19 -06:00
smb2pdu.c ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr 2023-04-13 16:55:29 +02:00
smb2pdu.h ksmbd: limit pdu length size according to connection status 2023-02-01 08:34:38 +01:00
smb_common.c ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr 2023-04-13 16:55:29 +02:00
smb_common.h ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr 2023-04-13 16:55:29 +02:00
smbacl.c ksmbd: port to vfs{g,u}id_t and associated helpers 2022-10-05 01:15:37 -05:00
smbacl.h ksmbd: port to vfs{g,u}id_t and associated helpers 2022-10-05 01:15:37 -05:00
smbfsctl.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
smbstatus.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
transport_ipc.c ksmbd: add max connections parameter 2023-02-01 08:34:37 +01:00
transport_ipc.h ksmbd: throttle session setup failures to avoid dictionary attacks 2021-10-20 00:07:10 -05:00
transport_rdma.c ksmbd: don't terminate inactive sessions after a few seconds 2023-03-30 12:49:26 +02:00
transport_rdma.h ksmbd: fix wrong smbd max read/write size check 2022-05-21 15:01:43 -05:00
transport_tcp.c ksmbd: don't terminate inactive sessions after a few seconds 2023-03-30 12:49:26 +02:00
transport_tcp.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
unicode.c ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
unicode.h ksmbd: casefold utf-8 share names and fix ascii lowercase conversion 2022-10-05 01:15:37 -05:00
uniupr.h ksmbd: move fs/cifsd to fs/ksmbd 2021-06-28 16:28:31 +09:00
vfs_cache.c ksmbd: fix possible memory leak in smb2_lock() 2023-03-10 09:34:07 +01:00
vfs_cache.h ksmbd: remove filename in ksmbd_file 2022-04-14 20:56:13 -05:00
vfs.c vfs: fix copy_file_range() averts filesystem freeze protection 2022-11-25 00:52:28 -05:00
vfs.h ksmbd: make utf-8 file name comparison work in __caseless_lookup() 2022-10-05 01:15:44 -05:00
xattr.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00