Unverified Commit 141542da authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1737 ksmbd: fix out of bounds read in smb2_sess_setup 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Nan <linan122@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/BK3WNMWIWF7LUE5WR6V4SB366MLOBVAY/ 
 
https://gitee.com/openeuler/kernel/issues/I7SVRC 
 
Link:https://gitee.com/openeuler/kernel/pulls/1737

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents aa2c8813 6a896802

fs/ksmbd/smb2pdu.c

+17 −14
Original line number Diff line number Diff line
@@ -1296,9 +1296,8 @@ static int decode_negotiation_token(struct ksmbd_conn *conn, 


static int ntlm_negotiate(struct ksmbd_work *work,

			  struct negotiate_message *negblob,

			  size_t negblob_len)

			  size_t negblob_len, struct smb2_sess_setup_rsp *rsp)

{

	struct smb2_sess_setup_rsp *rsp = smb2_get_msg(work->response_buf);

	struct challenge_message *chgblob;

	unsigned char *spnego_blob = NULL;

	u16 spnego_blob_len;
@@ -1403,10 +1402,10 @@ static struct ksmbd_user *session_user(struct ksmbd_conn *conn, 
	return user;

}



static int ntlm_authenticate(struct ksmbd_work *work)

static int ntlm_authenticate(struct ksmbd_work *work,

			     struct smb2_sess_setup_req *req,

			     struct smb2_sess_setup_rsp *rsp)

{

	struct smb2_sess_setup_req *req = smb2_get_msg(work->request_buf);

	struct smb2_sess_setup_rsp *rsp = smb2_get_msg(work->response_buf);

	struct ksmbd_conn *conn = work->conn;

	struct ksmbd_session *sess = work->sess;

	struct channel *chann = NULL;
@@ -1539,10 +1538,10 @@ static int ntlm_authenticate(struct ksmbd_work *work) 
}



#ifdef CONFIG_SMB_SERVER_KERBEROS5

static int krb5_authenticate(struct ksmbd_work *work)

static int krb5_authenticate(struct ksmbd_work *work,

			     struct smb2_sess_setup_req *req,

			     struct smb2_sess_setup_rsp *rsp)

{

	struct smb2_sess_setup_req *req = smb2_get_msg(work->request_buf);

	struct smb2_sess_setup_rsp *rsp = smb2_get_msg(work->response_buf);

	struct ksmbd_conn *conn = work->conn;

	struct ksmbd_session *sess = work->sess;

	char *in_blob, *out_blob;
@@ -1619,7 +1618,9 @@ static int krb5_authenticate(struct ksmbd_work *work) 
	return 0;

}

#else

static int krb5_authenticate(struct ksmbd_work *work)

static int krb5_authenticate(struct ksmbd_work *work,

			     struct smb2_sess_setup_req *req,

			     struct smb2_sess_setup_rsp *rsp)

{

	return -EOPNOTSUPP;

}
@@ -1628,8 +1629,8 @@ static int krb5_authenticate(struct ksmbd_work *work) 
int smb2_sess_setup(struct ksmbd_work *work)

{

	struct ksmbd_conn *conn = work->conn;

	struct smb2_sess_setup_req *req = smb2_get_msg(work->request_buf);

	struct smb2_sess_setup_rsp *rsp = smb2_get_msg(work->response_buf);

	struct smb2_sess_setup_req *req;

	struct smb2_sess_setup_rsp *rsp;

	struct ksmbd_session *sess;

	struct negotiate_message *negblob;

	unsigned int negblob_len, negblob_off;
@@ -1637,6 +1638,8 @@ int smb2_sess_setup(struct ksmbd_work *work) 


	ksmbd_debug(SMB, "Received request for session setup\n");



	WORK_BUFFERS(work, req, rsp);



	rsp->StructureSize = cpu_to_le16(9);

	rsp->SessionFlags = 0;

	rsp->SecurityBufferOffset = cpu_to_le16(72);
@@ -1753,7 +1756,7 @@ int smb2_sess_setup(struct ksmbd_work *work) 


		if (conn->preferred_auth_mech &

				(KSMBD_AUTH_KRB5 | KSMBD_AUTH_MSKRB5)) {

			rc = krb5_authenticate(work);

			rc = krb5_authenticate(work, req, rsp);

			if (rc) {

				rc = -EINVAL;

				goto out_err;
@@ -1767,7 +1770,7 @@ int smb2_sess_setup(struct ksmbd_work *work) 
			sess->Preauth_HashValue = NULL;

		} else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) {

			if (negblob->MessageType == NtLmNegotiate) {

				rc = ntlm_negotiate(work, negblob, negblob_len);

				rc = ntlm_negotiate(work, negblob, negblob_len, rsp);

				if (rc)

					goto out_err;

				rsp->hdr.Status =
@@ -1780,7 +1783,7 @@ int smb2_sess_setup(struct ksmbd_work *work) 
						le16_to_cpu(rsp->SecurityBufferLength) - 1);



			} else if (negblob->MessageType == NtLmAuthenticate) {

				rc = ntlm_authenticate(work);

				rc = ntlm_authenticate(work, req, rsp);

				if (rc)

					goto out_err;