Chih-Yen Chang 865be1cff2 ksmbd: fix global-out-of-bounds in smb2_find_context_vals ... commit 02f76c401d upstream. Add tag_len argument in smb2_find_context_vals() to avoid out-of-bound read when create_context's name_len is larger than tag length. [ 7.995411] ================================================================== [ 7.995866] BUG: KASAN: global-out-of-bounds in memcmp+0x83/0xa0 [ 7.996248] Read of size 8 at addr ffffffff8258d940 by task kworker/0:0/7 ... [ 7.998191] Call Trace: [ 7.998358] <TASK> [ 7.998503] dump_stack_lvl+0x33/0x50 [ 7.998743] print_report+0xcc/0x620 [ 7.999458] kasan_report+0xae/0xe0 [ 7.999895] kasan_check_range+0x35/0x1b0 [ 8.000152] memcmp+0x83/0xa0 [ 8.000347] smb2_find_context_vals+0xf7/0x1e0 [ 8.000635] smb2_open+0x1df2/0x43a0 [ 8.006398] handle_ksmbd_work+0x274/0x810 [ 8.006666] process_one_work+0x419/0x760 [ 8.006922] worker_thread+0x2a2/0x6f0 [ 8.007429] kthread+0x160/0x190 [ 8.007946] ret_from_fork+0x1f/0x30 [ 8.008181] </TASK> Cc: stable@vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod@gmail.com> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-05-24 17:36:54 +01:00
..
mgmt	ksmbd: fix racy issue while destroying session on multichannel	2023-05-17 11:50:28 +02:00
Kconfig	ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION	2021-11-18 19:16:07 +01:00
Makefile	…
asn1.c	…
asn1.h	…
auth.c	ksmbd: fix deadlock in ksmbd_find_crypto_ctx()	2023-05-17 11:50:29 +02:00
auth.h	ksmbd: fix racy issue while destroying session on multichannel	2023-05-17 11:50:28 +02:00
connection.c	ksmbd: allocate one more byte for implied bcc[0]	2023-05-24 17:36:54 +01:00
connection.h	ksmbd: fix racy issue while destroying session on multichannel	2023-05-17 11:50:28 +02:00
crypto_ctx.c	ksmbd: remove NTLMv1 authentication	2021-09-29 16:17:34 -05:00
crypto_ctx.h	ksmbd: remove NTLMv1 authentication	2021-09-29 16:17:34 -05:00
glob.h	ksmbd: fix version mismatch with out of tree	2021-10-07 10:18:34 -05:00
ksmbd_netlink.h	ksmbd: add max connections parameter	2023-02-01 08:27:24 +01:00
ksmbd_spnego_negtokeninit.asn1	…
ksmbd_spnego_negtokentarg.asn1	…
ksmbd_work.c	ksmbd: reorder and document on-disk and netlink structures in headers	2021-06-30 14:47:24 +09:00
ksmbd_work.h	ksmbd: change data type of volatile/persistent id to u64	2021-07-09 08:23:16 +09:00
misc.c	ksmbd: missing check for NULL in convert_to_nt_pathname()	2021-09-30 20:00:05 -05:00
misc.h	ksmbd: use LOOKUP_BENEATH to prevent the out of share access	2021-09-24 21:25:23 -05:00
ndr.c	ksmbd: downgrade ndr version error message to debug	2023-02-01 08:27:24 +01:00
ndr.h	ksmbd: add user namespace support	2021-07-02 16:27:10 +09:00
nterr.h	…
ntlmssp.h	…
oplock.c	ksmbd: fix global-out-of-bounds in smb2_find_context_vals	2023-05-24 17:36:54 +01:00
oplock.h	ksmbd: fix global-out-of-bounds in smb2_find_context_vals	2023-05-24 17:36:54 +01:00
server.c	ksmbd: call rcu_barrier() in ksmbd_server_exit()	2023-05-11 23:00:18 +09:00
server.h	ksmbd: add max connections parameter	2023-02-01 08:27:24 +01:00
smb2misc.c	ksmbd: smb2: Allow messages padded to 8byte boundary	2023-05-24 17:36:54 +01:00
smb2ops.c	ksmbd: add support for smb2 max credit parameter	2022-01-27 11:02:53 +01:00
smb2pdu.c	ksmbd: fix global-out-of-bounds in smb2_find_context_vals	2023-05-24 17:36:54 +01:00
smb2pdu.h	ksmbd: limit pdu length size according to connection status	2023-02-01 08:27:24 +01:00
smb_common.c	ksmbd: return unsupported error on smb1 mount	2023-03-30 12:47:58 +02:00
smb_common.h	ksmbd: fix racy issue while destroying session on multichannel	2023-05-17 11:50:28 +02:00
smbacl.c	ksmbd: fix heap-based overflow in set_ntacl_dacl()	2022-08-21 15:17:48 +02:00
smbacl.h	ksmbd: fix heap-based overflow in set_ntacl_dacl()	2022-08-21 15:17:48 +02:00
smbfsctl.h	…
smbstatus.h	…
transport_ipc.c	ksmbd: add max connections parameter	2023-02-01 08:27:24 +01:00
transport_ipc.h	ksmbd: throttle session setup failures to avoid dictionary attacks	2021-10-20 00:07:10 -05:00
transport_rdma.c	ksmbd: don't terminate inactive sessions after a few seconds	2023-04-05 11:24:52 +02:00
transport_rdma.h	ksmbd: add smbd max io size parameter	2023-02-01 08:27:24 +01:00
transport_tcp.c	ksmbd: don't terminate inactive sessions after a few seconds	2023-04-05 11:24:52 +02:00
transport_tcp.h	…
unicode.c	…
unicode.h	…
uniupr.h	…
vfs.c	ksmbd: fix racy issue while destroying session on multichannel	2023-05-17 11:50:28 +02:00
vfs.h	ksmbd: don't align last entry offset in smb2 query directory	2022-02-23 12:03:18 +01:00
vfs_cache.c	ksmbd: fix racy issue while destroying session on multichannel	2023-05-17 11:50:28 +02:00
vfs_cache.h	ksmbd: remove unused ksmbd_file_table_flush function	2021-09-03 23:29:45 -05:00
xattr.h	ksmbd: reorder and document on-disk and netlink structures in headers	2021-06-30 14:47:24 +09:00