iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs/smb/server
History
Namjae Jeon 330d900620 ksmbd: fix out of bounds in init_smb2_rsp_hdr() 
[ Upstream commit 536bb492d39bb6c080c92f31e8a55fe9934f452b ]

If client send smb2 negotiate request and then send smb1 negotiate
request, init_smb2_rsp_hdr is called for smb1 negotiate request since
need_neg is set to false. This patch ignore smb1 packets after ->need_neg
is set to false.

Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21541
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-13 09:42:21 +02:00
..
mgmt
…
asn1.c
…
asn1.h
…
auth.c
ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
2023-09-06 21:26:59 +01:00
auth.h
…
connection.c
…
connection.h
…
crypto_ctx.c
…
crypto_ctx.h
…
glob.h
…
Kconfig
…
ksmbd_netlink.h
…
ksmbd_spnego_negtokeninit.asn1
…
ksmbd_spnego_negtokentarg.asn1
…
ksmbd_work.c
…
ksmbd_work.h
…
Makefile
…
misc.c
…
misc.h
…
ndr.c
…
ndr.h
…
nterr.h
…
ntlmssp.h
…
oplock.c
ksmbd: fix wrong DataOffset validation of create context
2023-09-06 21:26:59 +01:00
oplock.h
…
server.c
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
2023-09-13 09:42:21 +02:00
server.h
…
smb2misc.c
ksmbd: validate command request size
2023-08-16 18:27:20 +02:00
smb2ops.c
…
smb2pdu.c
ksmbd: no response from compound read
2023-09-13 09:42:21 +02:00
smb2pdu.h
ksmbd: replace one-element array with flex-array member in struct smb2_ea_info
2023-09-06 21:26:59 +01:00
smb_common.c
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
2023-09-13 09:42:21 +02:00
smb_common.h
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
2023-09-13 09:42:21 +02:00
smbacl.c
…
smbacl.h
…
smbfsctl.h
…
smbstatus.h
…
transport_ipc.c
…
transport_ipc.h
…
transport_rdma.c
ksmbd: reduce descriptor size if remaining bytes is less than request size
2023-09-06 21:26:59 +01:00
transport_rdma.h
…
transport_tcp.c
…
transport_tcp.h
…
unicode.c
…
unicode.h
…
uniupr.h
…
vfs_cache.c
…
vfs_cache.h
…
vfs.c
…
vfs.h
…
xattr.h
…