5.15-stable patches

added patches:
	ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch
	ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch

diff --git a/queue-5.15/ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch b/queue-5.15/ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch
new file mode 100644 (file)
index 0000000..2c10587
--- /dev/null
+++ b/queue-5.15/ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch
@@ -0,0 +1,41 @@
+From 797805d81baa814f76cf7bdab35f86408a79d707 Mon Sep 17 00:00:00 2001
+From: William Liu <will@willsroot.io>
+Date: Fri, 30 Dec 2022 13:03:15 +0900
+Subject: ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: William Liu <will@willsroot.io>
+
+commit 797805d81baa814f76cf7bdab35f86408a79d707 upstream.
+
+"nt_len - CIFS_ENCPWD_SIZE" is passed directly from
+ksmbd_decode_ntlmssp_auth_blob to ksmbd_auth_ntlmv2. Malicious requests
+can set nt_len to less than CIFS_ENCPWD_SIZE, which results in a negative
+number (or large unsigned value) used for a subsequent memcpy in
+ksmbd_auth_ntlvm2 and can cause a panic.
+
+Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
+Cc: stable@vger.kernel.org
+Signed-off-by: William Liu <will@willsroot.io>
+Signed-off-by: Hrvoje Mišetić <misetichrvoje@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ksmbd/auth.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ksmbd/auth.c
++++ b/fs/ksmbd/auth.c
+@@ -319,7 +319,8 @@ int ksmbd_decode_ntlmssp_auth_blob(struc
+       dn_off = le32_to_cpu(authblob->DomainName.BufferOffset);
+       dn_len = le16_to_cpu(authblob->DomainName.Length);
+ 
+-      if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len)
++      if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len ||
++          nt_len < CIFS_ENCPWD_SIZE)
+               return -EINVAL;
+ 
+       /* TODO : use domain name that imported from configuration file */

diff --git a/queue-5.15/ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch b/queue-5.15/ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch
new file mode 100644 (file)
index 0000000..f4a9bc7
--- /dev/null
+++ b/queue-5.15/ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch
@@ -0,0 +1,69 @@
+From 83dcedd5540d4ac61376ddff5362f7d9f866a6ec Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Sat, 31 Dec 2022 17:32:31 +0900
+Subject: ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit 83dcedd5540d4ac61376ddff5362f7d9f866a6ec upstream.
+
+If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round
+again, It will cause infinite loop issue. And all threads from next
+connections would be doing that. This patch add max retry count(2) to
+avoid it. kernel_recvmsg() will wait during 7sec timeout and try to
+retry two time if -EAGAIN is returned. And add flags of kvmalloc to
+__GFP_NOWARN and __GFP_NORETRY to disconnect immediately without
+retrying on memory alloation failure.
+
+Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
+Cc: stable@vger.kernel.org
+Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ksmbd/connection.c    |    7 +++++--
+ fs/ksmbd/transport_tcp.c |    5 ++++-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/fs/ksmbd/connection.c
++++ b/fs/ksmbd/connection.c
+@@ -310,9 +310,12 @@ int ksmbd_conn_handler_loop(void *p)
+ 
+               /* 4 for rfc1002 length field */
+               size = pdu_size + 4;
+-              conn->request_buf = kvmalloc(size, GFP_KERNEL);
++              conn->request_buf = kvmalloc(size,
++                                           GFP_KERNEL |
++                                           __GFP_NOWARN |
++                                           __GFP_NORETRY);
+               if (!conn->request_buf)
+-                      continue;
++                      break;
+ 
+               memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
+               if (!ksmbd_smb_request(conn))
+--- a/fs/ksmbd/transport_tcp.c
++++ b/fs/ksmbd/transport_tcp.c
+@@ -295,6 +295,7 @@ static int ksmbd_tcp_readv(struct tcp_tr
+       struct msghdr ksmbd_msg;
+       struct kvec *iov;
+       struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn;
++      int max_retry = 2;
+ 
+       iov = get_conn_iovec(t, nr_segs);
+       if (!iov)
+@@ -321,9 +322,11 @@ static int ksmbd_tcp_readv(struct tcp_tr
+               } else if (conn->status == KSMBD_SESS_NEED_RECONNECT) {
+                       total_read = -EAGAIN;
+                       break;
+-              } else if (length == -ERESTARTSYS || length == -EAGAIN) {
++              } else if ((length == -ERESTARTSYS || length == -EAGAIN) &&
++                         max_retry) {
+                       usleep_range(1000, 2000);
+                       length = 0;
++                      max_retry--;
+                       continue;
+               } else if (length <= 0) {
+                       total_read = -EAGAIN;

diff --git a/queue-5.15/series b/queue-5.15/series
index 9bfd18528e3aa77f5a9d6e7bf950a30e93d12e85..9cb0fa9531895d8801733bcd0eac1959546c734f 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -275,3 +275,5 @@ drm-i915-gvt-fix-gvt-debugfs-destroy.patch
 drm-i915-gvt-fix-vgpu-debugfs-clean-in-remove.patch
 hfs-hfsplus-use-warn_on-for-sanity-check.patch
 hfs-hfsplus-avoid-warn_on-for-sanity-check-use-proper-error-handling.patch
+ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch
+ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch