Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag '6.4-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd
Pull ksmbd server fixes from Steve French:
- two fixes for incorrect SMB3 message validation (one for client which
uses 8 byte padding, and one for empty bcc)
- two fixes for out of bounds bugs: one for username offset checks (in
session setup) and the other for create context name length checks in
open requests
* tag '6.4-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: smb2: Allow messages padded to 8byte boundary
ksmbd: allocate one more byte for implied bcc[0]
ksmbd: fix wrong UserName check in session_user
ksmbd: fix global-out-of-bounds in smb2_find_context_vals
+19
-15
+2
-1
fs/ksmbd/connection.c
+2
-1
fs/ksmbd/connection.c
+3
-2
fs/ksmbd/oplock.c
+3
-2
fs/ksmbd/oplock.c
···
1449
1449
* smb2_find_context_vals() - find a particular context info in open request
1450
1450
* @open_req: buffer containing smb2 file open(create) request
1451
1451
* @tag: context name to search for
1452
+
* @tag_len: the length of tag
1452
1453
*
1453
1454
* Return: pointer to requested context, NULL if @str context not found
1454
1455
* or error pointer if name length is invalid.
1455
1456
*/
1456
-
struct create_context *smb2_find_context_vals(void *open_req, const char *tag)
1457
+
struct create_context *smb2_find_context_vals(void *open_req, const char *tag, int tag_len)
1457
1458
{
1458
1459
struct create_context *cc;
1459
1460
unsigned int next = 0;
···
1493
1492
return ERR_PTR(-EINVAL);
1494
1493
1495
1494
name = (char *)cc + name_off;
1496
-
if (memcmp(name, tag, name_len) == 0)
1495
+
if (name_len == tag_len && !memcmp(name, tag, name_len))
1497
1496
return cc;
1498
1497
1499
1498
remain_len -= next;
+1
-1
fs/ksmbd/oplock.h
+1
-1
fs/ksmbd/oplock.h
···
118
118
void create_mxac_rsp_buf(char *cc, int maximal_access);
119
119
void create_disk_id_rsp_buf(char *cc, __u64 file_id, __u64 vol_id);
120
120
void create_posix_rsp_buf(char *cc, struct ksmbd_file *fp);
121
-
struct create_context *smb2_find_context_vals(void *open_req, const char *str);
121
+
struct create_context *smb2_find_context_vals(void *open_req, const char *tag, int tag_len);
122
122
struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn,
123
123
char *lease_key);
124
124
int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci,
+4
-1
fs/ksmbd/smb2misc.c
+4
-1
fs/ksmbd/smb2misc.c
···
416
416
417
417
/*
418
418
* Allow a message that padded to 8byte boundary.
419
+
* Linux 4.19.217 with smb 3.0.2 are sometimes
420
+
* sending messages where the cls_len is exactly
421
+
* 8 bytes less than len.
419
422
*/
420
-
if (clc_len < len && (len - clc_len) < 8)
423
+
if (clc_len < len && (len - clc_len) <= 8)
421
424
goto validate_credit;
422
425
423
426
pr_err_ratelimited(
+9
-10
fs/ksmbd/smb2pdu.c
+9
-10
fs/ksmbd/smb2pdu.c
···
1356
1356
struct authenticate_message *authblob;
1357
1357
struct ksmbd_user *user;
1358
1358
char *name;
1359
-
unsigned int auth_msg_len, name_off, name_len, secbuf_len;
1359
+
unsigned int name_off, name_len, secbuf_len;
1360
1360
1361
1361
secbuf_len = le16_to_cpu(req->SecurityBufferLength);
1362
1362
if (secbuf_len < sizeof(struct authenticate_message)) {
···
1366
1366
authblob = user_authblob(conn, req);
1367
1367
name_off = le32_to_cpu(authblob->UserName.BufferOffset);
1368
1368
name_len = le16_to_cpu(authblob->UserName.Length);
1369
-
auth_msg_len = le16_to_cpu(req->SecurityBufferOffset) + secbuf_len;
1370
1369
1371
-
if (auth_msg_len < (u64)name_off + name_len)
1370
+
if (secbuf_len < (u64)name_off + name_len)
1372
1371
return NULL;
1373
1372
1374
1373
name = smb_strndup_from_utf16((const char *)authblob + name_off,
···
2463
2464
return -ENOENT;
2464
2465
2465
2466
/* Parse SD BUFFER create contexts */
2466
-
context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER);
2467
+
context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER, 4);
2467
2468
if (!context)
2468
2469
return -ENOENT;
2469
2470
else if (IS_ERR(context))
···
2665
2666
2666
2667
if (req->CreateContextsOffset) {
2667
2668
/* Parse non-durable handle create contexts */
2668
-
context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER);
2669
+
context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER, 4);
2669
2670
if (IS_ERR(context)) {
2670
2671
rc = PTR_ERR(context);
2671
2672
goto err_out1;
···
2685
2686
}
2686
2687
2687
2688
context = smb2_find_context_vals(req,
2688
-
SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST);
2689
+
SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST, 4);
2689
2690
if (IS_ERR(context)) {
2690
2691
rc = PTR_ERR(context);
2691
2692
goto err_out1;
···
2696
2697
}
2697
2698
2698
2699
context = smb2_find_context_vals(req,
2699
-
SMB2_CREATE_TIMEWARP_REQUEST);
2700
+
SMB2_CREATE_TIMEWARP_REQUEST, 4);
2700
2701
if (IS_ERR(context)) {
2701
2702
rc = PTR_ERR(context);
2702
2703
goto err_out1;
···
2708
2709
2709
2710
if (tcon->posix_extensions) {
2710
2711
context = smb2_find_context_vals(req,
2711
-
SMB2_CREATE_TAG_POSIX);
2712
+
SMB2_CREATE_TAG_POSIX, 16);
2712
2713
if (IS_ERR(context)) {
2713
2714
rc = PTR_ERR(context);
2714
2715
goto err_out1;
···
3106
3107
struct create_alloc_size_req *az_req;
3107
3108
3108
3109
az_req = (struct create_alloc_size_req *)smb2_find_context_vals(req,
3109
-
SMB2_CREATE_ALLOCATION_SIZE);
3110
+
SMB2_CREATE_ALLOCATION_SIZE, 4);
3110
3111
if (IS_ERR(az_req)) {
3111
3112
rc = PTR_ERR(az_req);
3112
3113
goto err_out;
···
3133
3134
err);
3134
3135
}
3135
3136
3136
-
context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID);
3137
+
context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID, 4);
3137
3138
if (IS_ERR(context)) {
3138
3139
rc = PTR_ERR(context);
3139
3140
goto err_out;