mirror-linux/fs/smb/server
Namjae Jeon c8b5b7c5da ksmbd: fix null pointer dereference in alloc_preauth_hash()
The Client send malformed smb2 negotiate request. ksmbd return error
response. Subsequently, the client can send smb2 session setup even
thought conn->preauth_info is not allocated.
This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore
session setup request if smb2 negotiate phase is not complete.

Cc: stable@vger.kernel.org
Tested-by: Steve French <stfrench@microsoft.com>
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-26505
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-04-01 23:02:20 -05:00
..
mgmt ksmbd: fix null pointer dereference in alloc_preauth_hash() 2025-04-01 23:02:20 -05:00
Kconfig ksmbd: make SMB_SERVER_KERBEROS5 enable by default 2025-03-24 10:22:06 -05:00
Makefile
asn1.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
asn1.h
auth.c ksmbd: fix session use-after-free in multichannel connection 2025-04-01 00:04:21 -05:00
auth.h
connection.c ksmbd: prevent connection release during oplock break notification 2025-03-10 12:54:32 -05:00
connection.h ksmbd: fix null pointer dereference in alloc_preauth_hash() 2025-04-01 23:02:20 -05:00
crypto_ctx.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
crypto_ctx.h
glob.h ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
ksmbd_netlink.h ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL 2025-01-15 23:24:51 -06:00
ksmbd_spnego_negtokeninit.asn1
ksmbd_spnego_negtokentarg.asn1
ksmbd_work.c ksmbd: fix use-after-free in ksmbd_free_work_struct 2025-03-10 12:54:28 -05:00
ksmbd_work.h ksmbd: fix use-after-free in ksmbd_free_work_struct 2025-03-10 12:54:28 -05:00
misc.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
misc.h
ndr.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
ndr.h
nterr.h
ntlmssp.h
oplock.c ksmbd: fix r_count dec/increment mismatch 2025-03-27 19:12:00 -05:00
oplock.h ksmbd: fix use-after-free in ksmbd_free_work_struct 2025-03-10 12:54:28 -05:00
server.c ksmbd: prevent connection release during oplock break notification 2025-03-10 12:54:32 -05:00
server.h ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL 2025-01-15 23:24:51 -06:00
smb2misc.c smb: move SMB2 Status code to common header file 2024-09-15 10:42:44 -05:00
smb2ops.c ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1 2024-04-02 09:21:25 -05:00
smb2pdu.c ksmbd: fix null pointer dereference in alloc_preauth_hash() 2025-04-01 23:02:20 -05:00
smb2pdu.h ksmbd: Implement new SMB3 POSIX type 2025-01-07 18:48:49 -06:00
smb_common.c kernel-6.14-rc1.cred 2025-01-20 10:13:06 -08:00
smb_common.h ksmbd: check outstanding simultaneous SMB operations 2024-11-05 09:26:38 +09:00
smbacl.c ksmbd: validate zero num_subauth before sub_auth is accessed 2025-04-01 00:04:21 -05:00
smbacl.h smb: common: change the data type of num_aces to le16 2025-03-02 22:50:54 -06:00
smbfsctl.h
transport_ipc.c ksmbd: fix type confusion via race condition when using ipc_msg_send_request 2025-03-02 22:50:53 -06:00
transport_ipc.h ksmbd: Remove unused functions 2025-01-15 23:24:51 -06:00
transport_rdma.c ksmbd: use ib_device_get_netdev() instead of calling ops.get_netdev 2025-03-27 19:12:00 -05:00
transport_rdma.h
transport_tcp.c ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL 2025-01-15 23:24:51 -06:00
transport_tcp.h ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL 2025-01-15 23:24:51 -06:00
unicode.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
unicode.h
vfs.c VFS: Change vfs_mkdir() to return the dentry. 2025-03-05 11:52:50 +01:00
vfs.h ksmbd: Remove unused functions 2025-01-15 23:24:51 -06:00
vfs_cache.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
vfs_cache.h ksmbd: fix warning: comparison of distinct pointer types lacks a cast 2024-09-20 22:16:11 -05:00
xattr.h ksmbd: Correct typos in multiple comments across various files 2024-09-25 21:33:22 -05:00