github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/fs/smb/server
History
Namjae Jeon 5e1b924808 ksmbd: reject undersized decompressed SMB2 requests 
ksmbd_decompress_request() bounds the decompressed size only against
the maximum request size. A compression transform can therefore
produce a buffer smaller than an SMB2 PDU and install it as
conn->request_buf.

The receive path subsequently calls ksmbd_smb_request(), which reads
the protocol ID before the normal SMB2 minimum-size check. If the
decompressed output is too short, that read can access beyond the
request allocation.

Require the decompressed output to contain at least a complete minimum
SMB2 PDU before allocating and installing the replacement request
buffer.

Fixes: a08de24c2b ("ksmbd: negotiate and decode SMB2 compression")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-07-22 09:54:10 -05:00
..
mgmt ksmbd: remove stale channels from all sessions on teardown 2026-07-16 10:18:25 -05:00
asn1.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
asn1.h
auth.c ksmbd: handle channel binding with a different user 2026-07-06 07:55:41 -05:00
auth.h ksmbd: fix multichannel binding and enforce channel limit 2026-07-06 07:55:41 -05:00
compress.c ksmbd: reject undersized decompressed SMB2 requests 2026-07-22 09:54:10 -05:00
compress.h ksmbd: compress SMB2 READ responses 2026-06-16 18:57:22 -05:00
connection.c ksmbd: validate minimum PDU size for transform requests 2026-07-22 09:54:10 -05:00
connection.h ksmbd: negotiate and decode SMB2 compression 2026-06-16 18:57:22 -05:00
crypto_ctx.c ksmbd: Use AES-CMAC library for SMB3 signature calculation 2026-04-22 08:11:23 -05:00
crypto_ctx.h ksmbd: Use AES-CMAC library for SMB3 signature calculation 2026-04-22 08:11:23 -05:00
glob.h ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
Kconfig smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/ 2026-04-22 19:00:41 -05:00
ksmbd_netlink.h ksmbd: add max ip connections parameter 2025-09-30 21:37:54 -05:00
ksmbd_spnego_negtokeninit.asn1
ksmbd_spnego_negtokentarg.asn1
ksmbd_work.c ksmbd: keep common response iovecs in the work item 2026-06-22 20:15:04 -05:00
ksmbd_work.h ksmbd: fix outstanding credit leak on abort and error paths 2026-06-30 21:29:46 -05:00
Makefile ksmbd: negotiate and decode SMB2 compression 2026-06-16 18:57:22 -05:00
misc.c ksmbd: treat unnamed DATA stream as base file 2026-06-22 20:15:04 -05:00
misc.h ksmbd: fix path resolution in ksmbd_vfs_kern_path_create 2026-06-16 18:57:22 -05:00
ndr.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
ndr.h
ntlmssp.h
oplock.c ksmbd: pin conn during async oplock break notification 2026-07-16 10:18:25 -05:00
oplock.h ksmbd: avoid level II oplock break notification on unlink 2026-06-22 20:15:05 -05:00
proc.c ksmbd: add procfs interface for runtime monitoring and statistics 2026-02-08 20:25:16 -06:00
server.c ksmbd: enforce signing required by the session 2026-07-22 09:54:03 -05:00
server.h ksmbd: add max ip connections parameter 2025-09-30 21:37:54 -05:00
smb_common.c ksmbd: negotiate and decode SMB2 compression 2026-06-16 18:57:22 -05:00
smb_common.h smb: move filesystem_vol_info into common/fscc.h 2026-04-12 18:07:54 -05:00
smb2misc.c ksmbd: validate compound request size before reading StructureSize2 2026-07-16 10:18:25 -05:00
smb2ops.c ksmbd: add procfs interface for runtime monitoring and statistics 2026-02-08 20:25:16 -06:00
smb2pdu.c ksmbd: defer destroy_previous_session() until after NTLM authentication 2026-07-22 09:54:10 -05:00
smb2pdu.h smb/client: refresh allocation after EOF-extending fallocate 2026-07-13 10:37:55 -05:00
smbacl.c ksmbd: validate ACE size against SID sub-authorities 2026-07-22 09:54:10 -05:00
smbacl.h ksmbd: fix OOB write in QUERY_INFO for compound requests 2026-03-29 22:07:45 -05:00
stats.h ksmbd: add procfs interface for runtime monitoring and statistics 2026-02-08 20:25:16 -06:00
transport_ipc.c ksmbd: validate response sizes in ipc_validate_msg() 2026-04-18 12:19:59 -05:00
transport_ipc.h ksmbd: Remove unused functions 2025-01-15 23:24:51 -06:00
transport_rdma.c smb: smbdirect: introduce and use include/linux/smbdirect.h 2026-05-01 16:24:25 -05:00
transport_rdma.h smb: smbdirect: introduce and use include/linux/smbdirect.h 2026-05-01 16:24:25 -05:00
transport_tcp.c smb: server: fix max_connections off-by-one in tcp accept path 2026-04-18 12:19:59 -05:00
transport_tcp.h ksmbd: fix use-after-free in __smb2_lease_break_noti() 2025-04-14 22:21:26 -05:00
unicode.c ksmbd: use __GFP_RETRY_MAYFAIL 2024-11-25 18:58:02 -06:00
unicode.h
vfs_cache.c ksmbd: fix app-instance durable supersede session UAF 2026-06-30 21:29:46 -05:00
vfs_cache.h ksmbd: coalesce sub-15ms write time updates on close 2026-07-06 07:55:41 -05:00
vfs.c ksmbd: preserve VFS inherited POSIX ACL mask 2026-07-22 09:54:01 -05:00
vfs.h smb/server: implement FSCTL_SET_COMPRESSION ioctl handler 2026-06-16 18:57:21 -05:00
xattr.h ksmbd: Correct typos in multiple comments across various files 2024-09-25 21:33:22 -05:00