From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B54C5CA0FFC for ; Sat, 2 Sep 2023 08:22:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351158AbjIBIWS (ORCPT ); Sat, 2 Sep 2023 04:22:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229475AbjIBIWS (ORCPT ); Sat, 2 Sep 2023 04:22:18 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52F15CC for ; Sat, 2 Sep 2023 01:22:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F2224B82761 for ; Sat, 2 Sep 2023 08:22:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C2C7C433C8; Sat, 2 Sep 2023 08:22:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1693642932; bh=gisWDahTYIO9+OpR0K8moqQ7RoQ9jPC2WUPgUessOJI=; h=Subject:To:Cc:From:Date:From; b=ct4x9PehqGmEO3WC/fU9YPlpljG8ny1LBAt+OjIT4+ANicV/WDoQxLcVoI6/Ej78t Z+J8OJFRM/TJ5kLGvAb4+mjH0LXmRF/Kl1Z8ZQSokQDXYXGmm7ztORsJUPGX7QwM1Y +TFJrE73wrGgOCiTA2nhY4IPlv7Wr2OO0M8wffDg= Subject: FAILED: patch "[PATCH] ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()" failed to apply to 5.15-stable tree To: linkinjeon@kernel.org, stfrench@microsoft.com Cc: From: Date: Sat, 02 Sep 2023 10:22:09 +0200 Message-ID: <2023090209-knoll-slit-7eeb@gregkh> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 4b081ce0d830b684fdf967abc3696d1261387254 # git commit -s git send-email --to '' --in-reply-to '2023090209-knoll-slit-7eeb@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 4b081ce0d830b684fdf967abc3696d1261387254 Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Fri, 25 Aug 2023 23:40:31 +0900 Subject: [PATCH] ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21940 Signed-off-by: Namjae Jeon Signed-off-by: Steve French diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c index af7b2cdba126..229a6527870d 100644 --- a/fs/smb/server/auth.c +++ b/fs/smb/server/auth.c @@ -355,6 +355,9 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob, if (blob_len < (u64)sess_key_off + sess_key_len) return -EINVAL; + if (sess_key_len > CIFS_KEY_SIZE) + return -EINVAL; + ctx_arc4 = kmalloc(sizeof(*ctx_arc4), GFP_KERNEL); if (!ctx_arc4) return -ENOMEM;