Namjae Jeon 79ed288cef ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() ...

There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request
from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of
current smb2_ea_info. ksmbd need to validate buffer length Before
accessing the next ea. ksmbd should check buffer length using buf_len,
not next variable. next is the start offset of current ea that got from
previous ea.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21598
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

2023-08-05 20:57:00 -05:00

..

mgmt

ksmbd: remove unused ksmbd_tree_conn_share function

2023-06-26 00:07:04 -05:00

asn1.c

…

asn1.h

…

auth.c

…

auth.h

…

connection.c

ksmbd: validate smb request protocol id

2023-06-02 12:30:57 -05:00

connection.h

…

crypto_ctx.c

…

crypto_ctx.h

…

glob.h

…

Kconfig

…

ksmbd_netlink.h

ksmbd: check if a mount point is crossed during path lookup

2023-07-23 10:25:11 -05:00

ksmbd_spnego_negtokeninit.asn1

…

ksmbd_spnego_negtokentarg.asn1

…

ksmbd_work.c

…

ksmbd_work.h

…

Makefile

…

misc.c

…

misc.h

…

ndr.c

…

ndr.h

…

nterr.h

…

ntlmssp.h

…

oplock.c

ksmbd: fix out-of-bound read in parse_lease_state()

2023-06-02 12:30:57 -05:00

oplock.h

…

server.c

ksmbd: fix out of bounds in init_smb2_rsp_hdr()

2023-07-23 10:25:11 -05:00

server.h

…

smb2misc.c

ksmbd: validate command request size

2023-08-05 20:56:54 -05:00

smb2ops.c

…

smb2pdu.c

ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()

2023-08-05 20:57:00 -05:00

smb2pdu.h

…

smb_common.c

ksmbd: fix out of bounds in init_smb2_rsp_hdr()

2023-07-23 10:25:11 -05:00

smb_common.h

ksmbd: fix out of bounds in init_smb2_rsp_hdr()

2023-07-23 10:25:11 -05:00

smbacl.c

ksmbd: Replace the ternary conditional operator with min()

2023-06-26 00:07:04 -05:00

smbacl.h

…

smbfsctl.h

…

smbstatus.h

…

transport_ipc.c

ksmbd: use kvzalloc instead of kvmalloc

2023-06-26 00:07:04 -05:00

transport_ipc.h

…

transport_rdma.c

…

transport_rdma.h

…

transport_tcp.c

…

transport_tcp.h

…

unicode.c

…

unicode.h

…

uniupr.h

…

vfs_cache.c

ksmbd: add mnt_want_write to ksmbd vfs functions

2023-06-16 21:04:19 -05:00

vfs_cache.h

…

vfs.c

ksmbd: check if a mount point is crossed during path lookup

2023-07-23 10:25:11 -05:00

vfs.h

ksmbd: check if a mount point is crossed during path lookup

2023-07-23 10:25:11 -05:00

xattr.h

…