linux.git/fs/smb/server, branch v6.14

ksmbd: prevent connection release during oplock break notification

2025-03-10T17:54:32+00:00

ksmbd_work could be freed when after connection release.
Increment r_count of ksmbd_conn to indicate that requests
are not finished yet and to not release the connection.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix use-after-free in ksmbd_free_work_struct

2025-03-10T17:54:28+00:00

->interim_entry of ksmbd_work could be deleted after oplock is freed.
We don't need to manage it with linked list. The interim request could be
immediately sent whenever a oplock break wait is needed.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix incorrect validation for num_aces field of smb_acl

2025-03-03T04:50:54+00:00

parse_dcal() validate num_aces to allocate posix_ace_state_array.

if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))

It is an incorrect validation that we can create an array of size ULONG_MAX.
smb_acl has ->size field to calculate actual number of aces in request buffer
size. Use this to check invalid num_aces.

Reported-by: Igor Leite Ladessa 
Tested-by: Igor Leite Ladessa 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

smb: common: change the data type of num_aces to le16

2025-03-03T04:50:54+00:00

2.4.5 in [MS-DTYP].pdf describe the data type of num_aces as le16.

AceCount (2 bytes): An unsigned 16-bit integer that specifies the count
of the number of ACE records in the ACL.

Change it to le16 and add reserved field to smb_acl struct.

Reported-by: Igor Leite Ladessa 
Tested-by: Igor Leite Ladessa 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix bug on trap in smb2_lock

2025-03-03T04:50:53+00:00

If lock count is greater than 1, flags could be old value.
It should be checked with flags of smb_lock, not flags.
It will cause bug-on trap from locks_free_lock in error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix use-after-free in smb2_lock

2025-03-03T04:50:53+00:00

If smb_lock->zero_len has value, ->llist of smb_lock is not delete and
flock is old one. It will cause use-after-free on error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

2025-03-03T04:50:53+00:00

req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on
ida_alloc. req->handle from ksmbd_ipc_login_request and
FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion
between messages, resulting in access to unexpected parts of memory after
an incorrect delivery. ksmbd check type of ipc response but missing add
continue to check next ipc reponse.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix out-of-bounds in parse_sec_desc()

2025-03-03T04:50:53+00:00

If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd
struct size. If it is smaller, It could cause slab-out-of-bounds.
And when validating sid, It need to check it included subauth array size.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

Merge tag 'v6.14-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd

2025-01-24T01:00:11+00:00

Pull smb server updates from Steve French:
 "Three ksmbd server fixes:

   - Fix potential memory corruption in IPC calls

   - Support FSCTL_QUERY_INTERFACE_INFO for more configurations

   - Remove some unused functions"

* tag 'v6.14-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix integer overflows on 32 bit systems
  ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
  ksmbd: Remove unused functions

Merge tag 'kernel-6.14-rc1.cred' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-01-20T18:13:06+00:00

Pull cred refcount updates from Christian Brauner:
 "For the v6.13 cycle we switched overlayfs to a variant of
  override_creds() that doesn't take an extra reference. To this end the
  {override,revert}_creds_light() helpers were introduced.

  This generalizes the idea behind {override,revert}_creds_light() to
  the {override,revert}_creds() helpers. Afterwards overriding and
  reverting credentials is reference count free unless the caller
  explicitly takes a reference.

  All callers have been appropriately ported"

* tag 'kernel-6.14-rc1.cred' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (30 commits)
  cred: fold get_new_cred_many() into get_cred_many()
  cred: remove unused get_new_cred()
  nfsd: avoid pointless cred reference count bump
  cachefiles: avoid pointless cred reference count bump
  dns_resolver: avoid pointless cred reference count bump
  trace: avoid pointless cred reference count bump
  cgroup: avoid pointless cred reference count bump
  acct: avoid pointless reference count bump
  io_uring: avoid pointless cred reference count bump
  smb: avoid pointless cred reference count bump
  cifs: avoid pointless cred reference count bump
  cifs: avoid pointless cred reference count bump
  ovl: avoid pointless cred reference count bump
  open: avoid pointless cred reference count bump
  nfsfh: avoid pointless cred reference count bump
  nfs/nfs4recover: avoid pointless cred reference count bump
  nfs/nfs4idmap: avoid pointless reference count bump
  nfs/localio: avoid pointless cred reference count bumps
  coredump: avoid pointless cred reference count bump
  binfmt_misc: avoid pointless cred reference count bump
  ...