Namjae Jeon c8b5b7c5da ksmbd: fix null pointer dereference in alloc_preauth_hash() ...

The Client send malformed smb2 negotiate request. ksmbd return error
response. Subsequently, the client can send smb2 session setup even
thought conn->preauth_info is not allocated.
This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore
session setup request if smb2 negotiate phase is not complete.

Cc: stable@vger.kernel.org
Tested-by: Steve French <stfrench@microsoft.com>
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-26505
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

2025-04-01 23:02:20 -05:00

..

mgmt

ksmbd: fix null pointer dereference in alloc_preauth_hash()

2025-04-01 23:02:20 -05:00

asn1.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

asn1.h

…

auth.c

ksmbd: fix session use-after-free in multichannel connection

2025-04-01 00:04:21 -05:00

auth.h

…

connection.c

ksmbd: prevent connection release during oplock break notification

2025-03-10 12:54:32 -05:00

connection.h

ksmbd: fix null pointer dereference in alloc_preauth_hash()

2025-04-01 23:02:20 -05:00

crypto_ctx.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

crypto_ctx.h

…

glob.h

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

Kconfig

ksmbd: make SMB_SERVER_KERBEROS5 enable by default

2025-03-24 10:22:06 -05:00

ksmbd_netlink.h

ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL

2025-01-15 23:24:51 -06:00

ksmbd_spnego_negtokeninit.asn1

treewide: Add SPDX identifier to IETF ASN.1 modules

2023-10-27 18:04:28 +08:00

ksmbd_spnego_negtokentarg.asn1

treewide: Add SPDX identifier to IETF ASN.1 modules

2023-10-27 18:04:28 +08:00

ksmbd_work.c

ksmbd: fix use-after-free in ksmbd_free_work_struct

2025-03-10 12:54:28 -05:00

ksmbd_work.h

ksmbd: fix use-after-free in ksmbd_free_work_struct

2025-03-10 12:54:28 -05:00

Makefile

…

misc.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

misc.h

…

ndr.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

ndr.h

…

nterr.h

…

ntlmssp.h

…

oplock.c

ksmbd: fix r_count dec/increment mismatch

2025-03-27 19:12:00 -05:00

oplock.h

ksmbd: fix use-after-free in ksmbd_free_work_struct

2025-03-10 12:54:28 -05:00

server.c

ksmbd: prevent connection release during oplock break notification

2025-03-10 12:54:32 -05:00

server.h

ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL

2025-01-15 23:24:51 -06:00

smb2misc.c

smb: move SMB2 Status code to common header file

2024-09-15 10:42:44 -05:00

smb2ops.c

ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1

2024-04-02 09:21:25 -05:00

smb2pdu.c

ksmbd: fix null pointer dereference in alloc_preauth_hash()

2025-04-01 23:02:20 -05:00

smb2pdu.h

ksmbd: Implement new SMB3 POSIX type

2025-01-07 18:48:49 -06:00

smb_common.c

Merge tag 'kernel-6.14-rc1.cred' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-01-20 10:13:06 -08:00

smb_common.h

ksmbd: check outstanding simultaneous SMB operations

2024-11-05 09:26:38 +09:00

smbacl.c

ksmbd: validate zero num_subauth before sub_auth is accessed

2025-04-01 00:04:21 -05:00

smbacl.h

smb: common: change the data type of num_aces to le16

2025-03-02 22:50:54 -06:00

smbfsctl.h

…

transport_ipc.c

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

2025-03-02 22:50:53 -06:00

transport_ipc.h

ksmbd: Remove unused functions

2025-01-15 23:24:51 -06:00

transport_rdma.c

ksmbd: use ib_device_get_netdev() instead of calling ops.get_netdev

2025-03-27 19:12:00 -05:00

transport_rdma.h

…

transport_tcp.c

ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL

2025-01-15 23:24:51 -06:00

transport_tcp.h

ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL

2025-01-15 23:24:51 -06:00

unicode.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

unicode.h

fs/smb: Swing unicode common code from smb->NLS

2023-08-30 08:55:51 -05:00

vfs_cache.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

vfs_cache.h

ksmbd: fix warning: comparison of distinct pointer types lacks a cast

2024-09-20 22:16:11 -05:00

vfs.c

VFS: Change vfs_mkdir() to return the dentry.

2025-03-05 11:52:50 +01:00

vfs.h

ksmbd: Remove unused functions

2025-01-15 23:24:51 -06:00

xattr.h

ksmbd: Correct typos in multiple comments across various files

2024-09-25 21:33:22 -05:00