7.1-stable patches

added patches:
	ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch

diff --git a/queue-7.1/ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch b/queue-7.1/ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch
new file mode 100644 (file)
index 0000000..5943c6f
--- /dev/null
+++ b/queue-7.1/ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch
@@ -0,0 +1,91 @@
+From 610346149d047a52a92c9a0eb329dd565b8f92c5 Mon Sep 17 00:00:00 2001
+From: Gil Portnoy <dddhkts1@gmail.com>
+Date: Sun, 12 Jul 2026 00:00:00 +0000
+Subject: ksmbd: fix stack buffer overflow in multichannel session-key copy
+
+From: Gil Portnoy <dddhkts1@gmail.com>
+
+commit 610346149d047a52a92c9a0eb329dd565b8f92c5 upstream.
+
+Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel
+limit") moved the binding-path session key out of the session-wide
+sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and
+sized both that buffer and the on-stack copy used during binding with
+SMB2_NTLMV2_SESSKEY_SIZE (16):
+
+       struct channel {
+               char    sess_key[SMB2_NTLMV2_SESSKEY_SIZE];     /* 16 */
+               ...
+       };
+
+       ntlm_authenticate() / krb5_authenticate():
+               char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};        /* 16 */
+               char *auth_key = conn->binding ? channel_key : sess->sess_key;
+
+The two writers that fill this destination still bound the copy length
+against CIFS_KEY_SIZE (40), not against the 16-byte buffer:
+
+       ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange):
+               if (sess_key_len > CIFS_KEY_SIZE)       /* 40 */
+                       return -EINVAL;
+               arc4_crypt(ctx_arc4, sess_key,
+                          (char *)authblob + sess_key_off, sess_key_len);
+
+       ksmbd_krb5_authenticate():
+               if (resp->session_key_len > sizeof(sess->sess_key))     /* 40 */
+                       ...
+               memcpy(sess_key, resp->payload, resp->session_key_len);
+
+On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key,
+so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40
+bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose
+session key is longer than 16 bytes (a normal AES256 key is 32), writes
+past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow.
+KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called
+from ksmbd_decode_ntlmssp_auth_blob().
+
+The destinations must be able to hold the full session key the length
+checks already permit. Size the per-channel key buffer and the two
+on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key.
+
+Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
+Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/mgmt/user_session.h |    2 +-
+ fs/smb/server/smb2pdu.c           |    4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/smb/server/mgmt/user_session.h
++++ b/fs/smb/server/mgmt/user_session.h
+@@ -19,7 +19,7 @@
+ struct ksmbd_file_table;
+ 
+ struct channel {
+-      char                    sess_key[SMB2_NTLMV2_SESSKEY_SIZE];
++      char                    sess_key[CIFS_KEY_SIZE];
+       __u8                    smb3signingkey[SMB3_SIGN_KEY_SIZE];
+       struct ksmbd_conn       *conn;
+ };
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1507,7 +1507,7 @@ static int ntlm_authenticate(struct ksmb
+       struct ksmbd_conn *conn = work->conn;
+       struct ksmbd_session *sess = work->sess;
+       struct ksmbd_user *user;
+-      char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};
++      char channel_key[CIFS_KEY_SIZE] = {};
+       char *auth_key = conn->binding ? channel_key : sess->sess_key;
+       u64 prev_id;
+       bool binding = conn->binding;
+@@ -1644,7 +1644,7 @@ static int krb5_authenticate(struct ksmb
+       struct ksmbd_conn *conn = work->conn;
+       struct ksmbd_session *sess = work->sess;
+       char *in_blob, *out_blob;
+-      char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};
++      char channel_key[CIFS_KEY_SIZE] = {};
+       char *auth_key = conn->binding ? channel_key : sess->sess_key;
+       u64 prev_sess_id;
+       bool binding = conn->binding;

diff --git a/queue-7.1/series b/queue-7.1/series
index d8ac7bcef8ae31ccd80cab29eda34eacba1f135e..6ed8d631c545de094d5412a617768aaaf60628a6 100644 (file)
--- a/queue-7.1/series
+++ b/queue-7.1/series
@@ -1937,3 +1937,4 @@ ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
 ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
 gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch
 octeontx2-af-cn10k-restrict-vf-lmtline-sharing-to-its-own-pf.patch
+ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch