github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-23 06:31:58 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

smb: client: reject userspace cifs.spnego descriptions

Browse Source 
cifs.spnego key descriptions contain authority-bearing fields such as
pid, uid, creduid, and upcall_target that cifs.upcall treats as
kernel-originating inputs. However, userspace can also create keys of
this type through request_key(2) or add_key(2), allowing those fields to
be supplied without CIFS origin.

Only accept cifs.spnego descriptions while CIFS is using its private
spnego_cred to request the key.

Fixes: f1d662a7d5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos")
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Asim Viladi Oglu Manizada 2026-05-16 21:15:39 +00:00 committed by Steve French
parent 4d8690dace
commit 3da1fdf4ef
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
fs/smb/client/cifs_spnego.c
View File

@ -8,6 +8,7 @@
*/
#include <linux/list.h>
#include <linux/cred.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <keys/user-type.h>
@ -40,12 +41,27 @@ cifs_spnego_key_destroy(struct key *key)
kfree(key->payload.data[0]);
}
static int
cifs_spnego_key_vet_description(const char *description)
{
/*
* cifs.spnego descriptions are authority-bearing inputs to cifs.upcall.
* They are only valid when produced by CIFS while using the private
* spnego_cred installed below. Do not let userspace create this type
* of key through request_key(2)/add_key(2), since the helper treats
* pid/uid/creduid/upcall_target as kernel-originating fields.
*/
if (current_cred() != spnego_cred)
return -EPERM;
return 0;
}
/*
* keytype for CIFS spnego keys
*/
struct key_type cifs_spnego_key_type = {
.name = "cifs.spnego",
.vet_description = cifs_spnego_key_vet_description,
.instantiate = cifs_spnego_key_instantiate,
.destroy = cifs_spnego_key_destroy,
.describe = user_describe,