Namjae Jeon c119f4ede3 ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf ...

If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size
validation could be skipped. if request size is smaller than
sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in
smb2_allocate_rsp_buf(). This patch allocate response buffer after
decrypting transform request. smb3_decrypt_req() will validate transform
request size and avoid slab-out-of-bound in smb2_allocate_rsp_buf().

Reported-by: Norbert Szetei <norbert@doyensec.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

2024-04-19 20:48:47 -05:00

..

9p

fs/9p: fix uninitialized values during inode evict

2024-03-25 14:16:06 +00:00

adfs

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

affs

affs: remove SLAB_MEM_SPREAD flag usage

2024-02-26 11:36:28 +01:00

afs

afs: Fix occasional rmdir-then-VNOVNODE with generic/011

2024-03-14 12:13:21 +01:00

autofs

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2024-01-11 20:11:35 -08:00

bcachefs

Merge tag 'bcachefs-2024-04-10' of https://evilpiepirate.org/git/bcachefs

2024-04-11 11:24:55 -07:00

befs

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

bfs

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

btrfs

Merge tag 'for-6.9-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

2024-04-08 13:11:11 -07:00

cachefiles

cachefiles: fix memory leak in cachefiles_add_cache()

2024-02-20 09:46:07 +01:00

ceph

ceph: switch to use cap_delay_lock for the unlink delay list

2024-04-11 22:56:28 +02:00

coda

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

configfs

…

cramfs

fs,block: yield devices early

2024-03-27 13:17:15 +01:00

crypto

Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux

2024-03-12 13:17:36 -07:00

debugfs

debugfs: fix wait/cancellation handling during remove

2024-03-07 22:08:15 +00:00

devpts

fs: Remove the now superfluous sentinel elements from ctl_table array

2023-12-28 04:57:57 -08:00

dlm

Merge tag 'dlm-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm

2024-03-18 15:39:48 -07:00

ecryptfs

Merge tag 'exportfs-6.9' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/cel/linux

2024-01-23 17:56:30 +01:00

efivarfs

efivarfs: Drop 'duplicates' bool parameter on efivar_init()

2024-02-25 09:43:39 +01:00

efs

efs: remove SLAB_MEM_SPREAD flag usage

2024-02-27 11:21:33 +01:00

erofs

erofs: drop experimental warning for FSDAX

2024-03-25 10:48:15 +08:00

exfat

Merge tag 'exfat-for-6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat

2024-03-21 09:47:12 -07:00

exportfs

fs: Create a generic is_dot_dotdot() utility

2024-01-23 10:58:56 -05:00

ext2

Merge tag 'fs_for_v6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2024-03-13 14:30:58 -07:00

ext4

fs,block: yield devices early

2024-03-27 13:17:15 +01:00

f2fs

fs,block: yield devices early

2024-03-27 13:17:15 +01:00

fat

Merge tag 'mm-nonmm-stable-2024-03-14-09-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-03-14 18:03:09 -07:00

freevxfs

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

fuse

Merge tag 'fuse-update-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

2024-03-15 09:47:14 -07:00

gfs2

Merge tag 'gfs2-v6.8-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2

2024-03-25 10:53:39 -07:00

hfs

hfs: really remove hfs_writepage

2023-12-29 11:58:34 -08:00

hfsplus

Merge tag 'vfs-6.9.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-03-11 09:38:17 -07:00

hostfs

hostfs: use d_splice_alias() calling conventions to simplify failure exits

2023-12-21 12:51:00 -05:00

hpfs

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

hugetlbfs

Merge tag 'vfs-6.9.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-03-11 09:38:17 -07:00

iomap

Merge tag 'vfs-6.9.rw_hint' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs

2024-03-04 18:35:21 +01:00

isofs

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

jbd2

jbd2: abort journal when detecting metadata writeback error of fs dev

2024-01-04 23:42:21 -05:00

jffs2

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

jfs

fs,block: yield devices early

2024-03-27 13:17:15 +01:00

kernfs

kernfs: annotate different lockdep class for of->mutex of writable files

2024-04-14 06:55:46 -04:00

lockd

Merge tag 'nfsd-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2024-03-12 14:27:37 -07:00

minix

minix: remove SLAB_MEM_SPREAD flag usage

2024-02-27 11:21:32 +01:00

netfs

fscache: Fix error handling in fscache_begin_operation()

2024-03-18 10:33:48 +01:00

nfs

Merge tag 'nfs-for-6.9-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

2024-03-16 11:44:00 -07:00

nfs_common

…

nfsd

Merge tag 'nfsd-6.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2024-04-06 09:37:50 -07:00

nilfs2

nilfs2: prevent kernel bug at submit_bh_wbc()

2024-03-14 09:17:30 -07:00

nls

…

notify

fanotify: allow freeze when waiting response for permission events

2024-03-07 12:59:51 +01:00

ntfs3

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

ocfs2

Merge tag 'mm-nonmm-stable-2024-03-14-09-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-03-14 18:03:09 -07:00

omfs

…

openpromfs

openpromfs: remove SLAB_MEM_SPREAD flag usage

2024-02-27 11:21:32 +01:00

orangefs

Julia Lawall reported this null pointer dereference, this should fix it.

2024-02-14 15:57:53 -05:00

overlayfs

ovl: relax WARN_ON in ovl_verify_area()

2024-03-17 15:59:41 +02:00

proc

fs/proc: Skip bootloader comment if no embedded kernel parameters

2024-04-09 23:36:18 +09:00

pstore

pstore/zone: Don't clear memory twice

2024-03-09 12:33:22 -08:00

qnx4

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

qnx6

qnx6: remove SLAB_MEM_SPREAD flag usage

2024-02-27 11:21:32 +01:00

quota

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

ramfs

ramfs: Initialize security of in-memory inodes

2024-01-26 09:08:16 -08:00

reiserfs

fs,block: yield devices early

2024-03-27 13:17:15 +01:00

romfs

fs,block: yield devices early

2024-03-27 13:17:15 +01:00

smb

ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf

2024-04-19 20:48:47 -05:00

squashfs

Squashfs: fix variable overflow triggered by sysbot

2023-12-10 17:21:26 -08:00

sysfs

sysfs:Addresses documentation in sysfs_merge_group and sysfs_unmerge_group.

2024-03-07 22:04:50 +00:00

sysv

sysv: remove SLAB_MEM_SPREAD flag usage

2024-02-27 11:21:31 +01:00

tracefs

eventfs: Fix kernel-doc comments to functions

2024-04-11 17:42:09 -04:00

ubifs

Merge tag 'ubifs-for-linus-6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs

2024-03-21 15:09:29 -07:00

udf

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

ufs

mm, slab: remove last vestiges of SLAB_MEM_SPREAD

2024-03-12 20:32:19 -07:00

unicode

…

vboxsf

vboxsf: explicitly deny setlease attempts

2024-04-03 16:06:39 +02:00

verity

Merge tag 'net-next-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2024-03-12 17:44:08 -07:00

xfs

Merge tag 'xfs-6.9-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

2024-04-06 09:14:18 -07:00

zonefs

zonefs: Use str_plural() to fix Coccinelle warning

2024-04-10 07:23:47 +09:00

aio.c

aio: Fix null ptr deref in aio_complete() wakeup

2024-04-05 11:20:28 +02:00

anon_inodes.c

Merge branch 'kvm-guestmemfd' into HEAD

2023-11-14 08:31:31 -05:00

attr.c

Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2024-03-12 20:03:34 -07:00

backing-file.c

fs: Use KMEM_CACHE instead of kmem_cache_create

2024-02-02 13:11:50 +01:00

bad_inode.c

…

binfmt_elf_fdpic.c

binfmt: replace deprecated strncpy

2024-03-21 20:20:52 -07:00

binfmt_elf_test.c

…

binfmt_elf.c

…

binfmt_flat.c

…

binfmt_misc.c

Merge tag 'execve-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2023-10-30 19:28:19 -10:00

binfmt_script.c

…

buffer.c

Merge tag 'vfs-6.9.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-03-11 10:07:03 -07:00

char_dev.c

Merge tag 'mm-nonmm-stable-2023-11-02-14-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2023-11-02 20:53:31 -10:00

compat_binfmt_elf.c

…

coredump.c

iov_iter: get rid of 'copy_mc' flag

2024-03-06 10:52:12 +01:00

d_path.c

…

dax.c

fs : Fix warning using plain integer as NULL

2023-11-18 15:00:01 +01:00

dcache.c

Merge tag 'vfs-6.9.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-03-11 09:38:17 -07:00

direct-io.c

block, fs: Restore the per-bio/request data lifetime fields

2024-02-06 14:31:05 +01:00

drop_caches.c

…

eventfd.c

eventfd: strictly check the count parameter of eventfd_write to avoid inputting illegal strings

2024-02-08 10:12:26 +01:00

eventpoll.c

Merge tag 'net-next-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2024-03-12 17:44:08 -07:00

exec.c

Merge tag 'execve-v6.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2024-03-27 09:57:30 -07:00

fcntl.c

Merge tag 'vfs-6.9.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-03-11 10:07:03 -07:00

fhandle.c

do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak

2024-01-22 15:33:38 +01:00

file_table.c

Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2024-03-12 20:03:34 -07:00

file.c

file: remove __receive_fd()

2023-12-12 14:24:14 +01:00

filesystems.c

…

fs_context.c

…

fs_parser.c

__fs_parse: Correct a documentation comment

2024-02-02 13:11:50 +01:00

fs_pin.c

…

fs_struct.c

…

fs_types.c

…

fs-writeback.c

writeback: move wb_wakeup_delayed defination to fs-writeback.c

2024-01-22 15:33:38 +01:00

fsopen.c

…

init.c

…

inode.c

Merge tag 'bcachefs-2024-03-13' of https://evilpiepirate.org/git/bcachefs

2024-03-15 09:00:09 -07:00

internal.h

pidfs: remove config option

2024-03-13 12:53:53 -07:00

ioctl.c

fs: add FS_IOC_GETFSSYSFSPATH

2024-02-12 13:13:59 +01:00

Kconfig

Merge tag 'mm-stable-2024-03-13-20-04' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-03-14 17:43:30 -07:00

Kconfig.binfmt

…

kernel_read_file.c

…

libfs.c

pidfs: remove config option

2024-03-13 12:53:53 -07:00

locks.c

filelock: fix deadlock detection in POSIX locking

2024-02-20 09:53:33 +01:00

Makefile

Merge tag 'vfs-6.9.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-03-11 10:21:06 -07:00

mbcache.c

vfs: remove SLAB_MEM_SPREAD flag usage

2024-02-27 11:21:31 +01:00

mnt_idmapping.c

fs/mnt_idmapping.c: Return -EINVAL when no map is written

2024-02-08 10:12:37 +01:00

mount.h

mounts: keep list of mounts in an rbtree

2023-11-18 14:56:16 +01:00

mpage.c

block, fs: Restore the per-bio/request data lifetime fields

2024-02-06 14:31:05 +01:00

namei.c

security: Place security_path_post_mknod() where the original IMA call was

2024-04-03 10:21:32 -07:00

namespace.c

fs: relax mount_setattr() permission checks

2024-02-07 21:16:29 +01:00

nsfs.c

pidfs: remove config option

2024-03-13 12:53:53 -07:00

open.c

Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2024-03-12 20:03:34 -07:00

pidfs.c

pidfs: remove config option

2024-03-13 12:53:53 -07:00

pipe.c

fs/pipe: Convert to lockdep_cmp_fn

2024-02-02 13:11:49 +01:00

pnode.c

mounts: keep list of mounts in an rbtree

2023-11-18 14:56:16 +01:00

pnode.h

…

posix_acl.c

Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2024-03-12 20:03:34 -07:00

proc_namespace.c

namespace: extract show_path() helper

2023-11-18 14:56:16 +01:00

read_write.c

fsnotify: optionally pass access range in file permission hooks

2023-12-12 16:20:02 +01:00

readdir.c

fsnotify: optionally pass access range in file permission hooks

2023-12-12 16:20:02 +01:00

remap_range.c

remap_range: merge do_clone_file_range() into vfs_clone_file_range()

2024-02-06 17:07:21 +01:00

select.c

fs/select: rework stack allocation hack for clang

2024-02-20 09:23:52 +01:00

seq_file.c

…

signalfd.c

…

splice.c

fs: use splice_copy_file_range() inline helper

2023-12-12 16:20:02 +01:00

stack.c

…

stat.c

Merge tag 'vfs-6.8.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-01-08 10:57:34 -08:00

statfs.c

…

super.c

fs,block: yield devices early

2024-03-27 13:17:15 +01:00

sync.c

…

sysctls.c

fs: Remove the now superfluous sentinel elements from ctl_table array

2023-12-28 04:57:57 -08:00

timerfd.c

…

userfaultfd.c

userfaultfd: use per-vma locks in userfaultfd operations

2024-02-22 15:27:20 -08:00

utimes.c

…

xattr.c

evm: Move to LSM infrastructure

2024-02-15 23:43:47 -05:00