Namjae Jeon 712e01f32e ksmbd: fix slab out of bounds write in smb_inherit_dacl() ...

commit eebff19acaa35820cb09ce2ccb3d21bee2156ffb upstream.

slab out-of-bounds write is caused by that offsets is bigger than pntsd
allocation size. This patch add the check to validate 3 offsets using
allocation size.

Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-22271
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-11-28 17:20:01 +00:00

..

mgmt

ksmbd: fix race condition between tree conn lookup and disconnect

2023-10-04 21:56:28 -05:00

asn1.c

ksmbd: switch to use kmemdup_nul() helper

2023-08-29 12:30:19 -05:00

asn1.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

auth.c

ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

2023-08-29 12:30:20 -05:00

auth.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

connection.c

ksmbd: fix race condition between session lookup and expire

2023-10-04 20:21:48 -05:00

connection.h

ksmbd: fix race condition between session lookup and expire

2023-10-04 20:21:48 -05:00

crypto_ctx.c

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

crypto_ctx.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

glob.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

Kconfig

ksmbd: remove experimental warning

2023-09-03 21:06:36 -05:00

ksmbd_netlink.h

ksmbd: check if a mount point is crossed during path lookup

2023-07-23 10:25:11 -05:00

ksmbd_spnego_negtokeninit.asn1

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

ksmbd_spnego_negtokentarg.asn1

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

ksmbd_work.c

ksmbd: fix wrong interim response on compound

2023-08-29 12:30:19 -05:00

ksmbd_work.h

ksmbd: fix wrong interim response on compound

2023-08-29 12:30:19 -05:00

Makefile

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

misc.c

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

misc.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

ndr.c

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

ndr.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

nterr.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

ntlmssp.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

oplock.c

ksmbd: fix wrong DataOffset validation of create context

2023-08-29 12:30:20 -05:00

oplock.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

server.c

ksmbd: fix race condition between tree conn lookup and disconnect

2023-10-04 21:56:28 -05:00

server.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

smb2misc.c

ksmbd: return invalid parameter error response if smb2 request is invalid

2023-09-21 14:41:06 -05:00

smb2ops.c

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

smb2pdu.c

ksmbd: fix potential double free on smb2_read_pipe() error path

2023-10-12 22:44:11 -05:00

smb2pdu.h

ksmbd: replace one-element array with flex-array member in struct smb2_ea_info

2023-08-29 12:30:20 -05:00

smb_common.c

ksmbd: handle malformed smb1 message

2023-11-28 17:20:01 +00:00

smb_common.h

ksmbd: fix out of bounds in init_smb2_rsp_hdr()

2023-07-23 10:25:11 -05:00

smbacl.c

ksmbd: fix slab out of bounds write in smb_inherit_dacl()

2023-11-28 17:20:01 +00:00

smbacl.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

smbfsctl.h

cifs: correct references in Documentation to old fs/cifs path

2023-05-24 16:29:21 -05:00

smbstatus.h

cifs: correct references in Documentation to old fs/cifs path

2023-05-24 16:29:21 -05:00

transport_ipc.c

ksmbd: use kvzalloc instead of kvmalloc

2023-06-26 00:07:04 -05:00

transport_ipc.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

transport_rdma.c

ksmbd: reduce descriptor size if remaining bytes is less than request size

2023-08-29 12:30:20 -05:00

transport_rdma.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

transport_tcp.c

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

transport_tcp.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

unicode.c

fs/smb: Swing unicode common code from smb->NLS

2023-08-30 08:55:51 -05:00

unicode.h

fs/smb: Swing unicode common code from smb->NLS

2023-08-30 08:55:51 -05:00

vfs_cache.c

ksmbd: fix Null pointer dereferences in ksmbd_update_fstate()

2023-10-12 22:44:09 -05:00

vfs_cache.h

ksmbd: fix race condition with fp

2023-10-04 20:21:48 -05:00

vfs.c

ksmbd: fix recursive locking in vfs helpers

2023-11-28 17:20:01 +00:00

vfs.h

ksmbd: add support for read compound

2023-08-29 12:30:19 -05:00

xattr.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00