iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs/ksmbd
History
Namjae Jeon eb94740351 ksmbd: validate session id and tree id in the compound request 
commit 5005bcb4219156f1bf7587b185080ec1da08518e upstream.

This patch validate session id and tree id in compound request.
If first operation in the compound is SMB2 ECHO request, ksmbd bypass
session and tree validation. So work->sess and work->tcon could be NULL.
If secound request in the compound access work->sess or tcon, It cause
NULL pointer dereferecing error.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21165
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-07-23 13:47:39 +02:00
..
mgmt
ksmbd: fix racy issue while destroying session on multichannel
2023-05-17 11:50:28 +02:00
asn1.c
…
asn1.h
…
auth.c
ksmbd: fix deadlock in ksmbd_find_crypto_ctx()
2023-05-17 11:50:29 +02:00
auth.h
ksmbd: fix racy issue while destroying session on multichannel
2023-05-17 11:50:28 +02:00
connection.c
ksmbd: allocate one more byte for implied bcc[0]
2023-05-24 17:36:54 +01:00
connection.h
ksmbd: fix racy issue while destroying session on multichannel
2023-05-17 11:50:28 +02:00
crypto_ctx.c
ksmbd: remove NTLMv1 authentication
2021-09-29 16:17:34 -05:00
crypto_ctx.h
ksmbd: remove NTLMv1 authentication
2021-09-29 16:17:34 -05:00
glob.h
ksmbd: fix version mismatch with out of tree
2021-10-07 10:18:34 -05:00
Kconfig
ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION
2021-11-18 19:16:07 +01:00
ksmbd_netlink.h
ksmbd: add max connections parameter
2023-02-01 08:27:24 +01:00
ksmbd_spnego_negtokeninit.asn1
…
ksmbd_spnego_negtokentarg.asn1
…
ksmbd_work.c
ksmbd: reorder and document on-disk and netlink structures in headers
2021-06-30 14:47:24 +09:00
ksmbd_work.h
ksmbd: change data type of volatile/persistent id to u64
2021-07-09 08:23:16 +09:00
Makefile
…
misc.c
ksmbd: missing check for NULL in convert_to_nt_pathname()
2021-09-30 20:00:05 -05:00
misc.h
ksmbd: use LOOKUP_BENEATH to prevent the out of share access
2021-09-24 21:25:23 -05:00
ndr.c
ksmbd: downgrade ndr version error message to debug
2023-02-01 08:27:24 +01:00
ndr.h
ksmbd: add user namespace support
2021-07-02 16:27:10 +09:00
nterr.h
…
ntlmssp.h
…
oplock.c
ksmbd: fix global-out-of-bounds in smb2_find_context_vals
2023-05-24 17:36:54 +01:00
oplock.h
ksmbd: fix global-out-of-bounds in smb2_find_context_vals
2023-05-24 17:36:54 +01:00
server.c
ksmbd: validate session id and tree id in the compound request
2023-07-23 13:47:39 +02:00
server.h
ksmbd: add max connections parameter
2023-02-01 08:27:24 +01:00
smb2misc.c
ksmbd: fix out-of-bound read in smb2_write
2023-07-23 13:47:38 +02:00
smb2ops.c
ksmbd: add support for smb2 max credit parameter
2022-01-27 11:02:53 +01:00
smb2pdu.c
ksmbd: validate session id and tree id in the compound request
2023-07-23 13:47:39 +02:00
smb2pdu.h
ksmbd: limit pdu length size according to connection status
2023-02-01 08:27:24 +01:00
smb_common.c
ksmbd: avoid field overflow warning
2023-07-23 13:47:18 +02:00
smb_common.h
ksmbd: fix racy issue while destroying session on multichannel
2023-05-17 11:50:28 +02:00
smbacl.c
ksmbd: fix heap-based overflow in set_ntacl_dacl()
2022-08-21 15:17:48 +02:00
smbacl.h
ksmbd: fix heap-based overflow in set_ntacl_dacl()
2022-08-21 15:17:48 +02:00
smbfsctl.h
…
smbstatus.h
…
transport_ipc.c
ksmbd: add max connections parameter
2023-02-01 08:27:24 +01:00
transport_ipc.h
ksmbd: throttle session setup failures to avoid dictionary attacks
2021-10-20 00:07:10 -05:00
transport_rdma.c
ksmbd: don't terminate inactive sessions after a few seconds
2023-04-05 11:24:52 +02:00
transport_rdma.h
ksmbd: add smbd max io size parameter
2023-02-01 08:27:24 +01:00
transport_tcp.c
ksmbd: don't terminate inactive sessions after a few seconds
2023-04-05 11:24:52 +02:00
transport_tcp.h
…
unicode.c
…
unicode.h
…
uniupr.h
…
vfs_cache.c
ksmbd: fix racy issue while destroying session on multichannel
2023-05-17 11:50:28 +02:00
vfs_cache.h
ksmbd: remove unused ksmbd_file_table_flush function
2021-09-03 23:29:45 -05:00
vfs.c
ksmbd: fix racy issue while destroying session on multichannel
2023-05-17 11:50:28 +02:00
vfs.h
ksmbd: don't align last entry offset in smb2 query directory
2022-02-23 12:03:18 +01:00
xattr.h
ksmbd: reorder and document on-disk and netlink structures in headers
2021-06-30 14:47:24 +09:00