Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/fs
History
Paulo Alcantara 9011b2c0fe smb: client: fix OOB in smbCalcSize() 
[ Upstream commit b35858b3786ddbb56e1c35138ba25d6adf8d0bef ]

Validate @smb->WordCount to avoid reading off the end of @smb and thus
causing the following KASAN splat:

  BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs]
  Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328

  CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x4a/0x80
   print_report+0xcf/0x650
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? __phys_addr+0x46/0x90
   kasan_report+0xd8/0x110
   ? smbCalcSize+0x32/0x40 [cifs]
   ? smbCalcSize+0x32/0x40 [cifs]
   kasan_check_range+0x105/0x1b0
   smbCalcSize+0x32/0x40 [cifs]
   checkSMB+0x162/0x370 [cifs]
   ? __pfx_checkSMB+0x10/0x10 [cifs]
   cifs_handle_standard+0xbc/0x2f0 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   cifs_demultiplex_thread+0xed1/0x1360 [cifs]
   ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? lockdep_hardirqs_on_prepare+0x136/0x210
   ? __pfx_lock_release+0x10/0x10
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? mark_held_locks+0x1a/0x90
   ? lockdep_hardirqs_on_prepare+0x136/0x210
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? __kthread_parkme+0xce/0xf0
   ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
   kthread+0x18d/0x1d0
   ? kthread+0xdb/0x1d0
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x34/0x60
   ? __pfx_kthread+0x10/0x10
   ret_from_fork_asm+0x1b/0x30
   </TASK>

This fixes CVE-2023-6606.

Reported-by: j51569436@gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218
Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:12:02 +01:00
..
9p Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
adfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
affs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
afs afs: Fix overwriting of result of DNS query 2024-11-18 12:11:59 +01:00
autofs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
befs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
btrfs btrfs: do not allow non subvolume root targets for snapshot 2024-11-18 12:12:00 +01:00
cachefiles Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ceph ceph: fix type promotion bug on 32bit systems 2024-11-08 11:25:50 +01:00
cifs smb: client: fix OOB in smbCalcSize() 2024-11-18 12:12:02 +01:00
coda Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
configfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crypto Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debugfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
devpts Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ecryptfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
efivarfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
efs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
erofs BACKPORT: erofs: fix lz4 inplace decompression 2024-11-17 17:41:30 +01:00
exfat exfat: support handle zero-size directory 2024-11-18 11:43:14 +01:00
exportfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ext2 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ext4 ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS 2024-11-18 12:11:57 +01:00
f2fs f2fs: avoid format-overflow warning 2024-11-18 11:43:31 +01:00
fat Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
freevxfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fscache Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fuse fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() 2024-11-18 12:11:50 +01:00
gfs2 gfs2: Silence "suspicious RCU usage in gfs2_permission" warning 2024-11-18 11:43:19 +01:00
hfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hfsplus Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hostfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hpfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hugetlbfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
incfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iomap Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
isofs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
jbd2 jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev 2024-11-18 11:43:25 +01:00
jffs2 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
jfs jfs: fix array-index-out-of-bounds in diAlloc 2024-11-18 11:43:14 +01:00
kernfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lockd Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
minix Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfs NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO 2024-11-18 11:43:19 +01:00
nfs_common Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfsd nfsd: lock_rename() needs both directories to live on the same fs 2024-11-18 12:10:57 +01:00
nilfs2 nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() 2024-11-18 12:11:41 +01:00
nls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
notify Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ntfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
omfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
openpromfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
orangefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
overlayfs ima: detect changes to the backing overlay file 2024-11-18 11:43:25 +01:00
proc watchdog: move softlockup_panic back to early_param 2024-11-18 11:43:21 +01:00
pstore pstore/platform: Add check for kstrdup 2024-11-18 11:42:47 +01:00
qnx4 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qnx6 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
quota quota: explicitly forbid quota files from being encrypted 2024-11-18 11:43:25 +01:00
ramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reiserfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
romfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sdfat Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
squashfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tracefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ubifs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ufs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
unicode Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vboxsf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
verity Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
zonefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
aio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
anon_inodes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
attr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bad_inode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_aout.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_elf_fdpic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_em86.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_flat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_misc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_script.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block_dev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
buffer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
char_dev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compat_binfmt_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
coredump.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
d_path.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dax.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dcache.c Revert "fs: set VFS cache pressure to 20" 2024-11-18 08:00:43 +01:00
dcookies.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
direct-io.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlog_hook.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drop_caches.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventpoll.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exec.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
fcntl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fhandle.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file_table.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
filesystems.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs-writeback.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_context.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_parser.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_pin.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_struct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_types.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fsopen.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
init.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode.c fs: add ctime accessors infrastructure 2024-11-18 12:11:13 +01:00
internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ioctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.binfmt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kernel_read_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
libfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
locks.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mbcache.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mount.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mpage.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
namei.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
no-block.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nsfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
open.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
pipe.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pnode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pnode.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
posix_acl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
proc_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
read_write.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
readdir.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
remap_range.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
select.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
seq_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
signalfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
splice.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stack.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
statfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
super.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sync.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
timerfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
userfaultfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utimes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xattr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00