linux-kernelorg-stable/fs
Namjae Jeon cce57cd8c5 ksmbd: fix null pointer dereference in alloc_preauth_hash()
commit c8b5b7c5da upstream.

The Client send malformed smb2 negotiate request. ksmbd return error
response. Subsequently, the client can send smb2 session setup even
thought conn->preauth_info is not allocated.
This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore
session setup request if smb2 negotiate phase is not complete.

Cc: stable@vger.kernel.org
Tested-by: Steve French <stfrench@microsoft.com>
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-26505
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Jan Alexander Preissler <akendo@akendo.eu>
Signed-off-by: Sujana Subramaniam <sujana.subramaniam@sap.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-19 16:32:08 +02:00
..
9p
adfs
affs
afs
autofs
befs
bfs
btrfs btrfs: fix corruption reading compressed range when block size is smaller than page size 2025-09-19 16:32:04 +02:00
cachefiles cachefiles: Fix the incorrect return value in __cachefiles_write() 2025-07-24 08:53:16 +02:00
ceph ceph: fix possible integer overflow in ceph_zero_objects() 2025-07-06 11:00:08 +02:00
coda
configfs configfs: Do not override creating attribute file failure in populate_attrs() 2025-06-27 11:08:42 +01:00
cramfs
crypto fscrypt: Don't use problematic non-inline crypto engines 2025-08-28 16:28:40 +02:00
debugfs
devpts
dlm
ecryptfs
efivarfs efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare 2025-09-04 15:30:26 +02:00
efs
erofs erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC 2025-09-04 15:30:19 +02:00
exfat exfat: add cluster chain loop check for dir 2025-08-28 16:28:28 +02:00
exportfs
ext2 ext2: Handle fiemap on empty files to prevent EINVAL 2025-08-28 16:28:15 +02:00
ext4 ext4: preserve SB_I_VERSION on remount 2025-08-28 16:28:44 +02:00
f2fs f2fs: fix to avoid out-of-boundary access in dnode page 2025-08-28 16:28:36 +02:00
fat
freevxfs
fscache
fuse fuse: prevent overflow in copy_file_range return value 2025-09-19 16:32:04 +02:00
gfs2 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops 2025-08-28 16:28:15 +02:00
hfs hfs: fix not erasing deleted b-tree node issue 2025-08-28 16:28:15 +02:00
hfsplus hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() 2025-08-28 16:28:14 +02:00
hostfs
hpfs
hugetlbfs mm: update memfd seal write check to include F_SEAL_WRITE 2025-08-28 16:28:39 +02:00
iomap
isofs isofs: Verify inode mode when loading from disk 2025-07-24 08:53:13 +02:00
jbd2 jbd2: prevent softlockup in jbd2_log_do_checkpoint() 2025-08-28 16:28:36 +02:00
jffs2 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places 2025-06-27 11:08:58 +01:00
jfs jfs: upper bound check of tree index in dbAllocAG 2025-08-28 16:28:26 +02:00
kernfs kernfs: Fix UAF in polling when open file is released 2025-09-19 16:32:05 +02:00
lockd
minix
netfs
nfs NFSv4/flexfiles: Fix layout merge mirror check. 2025-09-19 16:32:02 +02:00
nfs_common
nfsd NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() 2025-09-19 16:32:01 +02:00
nilfs2 nilfs2: reject invalid file types when reading inodes 2025-08-01 09:47:30 +01:00
nls
notify fanotify: sanitize handle_type values when reporting fid 2025-08-15 12:08:52 +02:00
ntfs
ntfs3 fs/ntfs3: correctly create symlink for relative path 2025-08-28 16:28:15 +02:00
ocfs2 ocfs2: fix recursive semaphore deadlock in fiemap call 2025-09-19 16:32:03 +02:00
omfs
openpromfs
orangefs fs/orangefs: use snprintf() instead of sprintf() 2025-08-28 16:28:25 +02:00
overlayfs ovl: Check for NULL d_inode() in ovl_dentry_upper() 2025-07-06 11:00:08 +02:00
proc proc: fix type confusion in pde_set_flags() 2025-09-19 16:32:02 +02:00
pstore
qnx4
qnx6
quota
ramfs
reiserfs
romfs
smb ksmbd: fix null pointer dereference in alloc_preauth_hash() 2025-09-19 16:32:08 +02:00
squashfs squashfs: fix memory leak in squashfs_fill_super 2025-08-28 16:28:43 +02:00
sysfs
sysv
tracefs tracefs: Add d_delete to remove negative dentries 2025-08-28 16:28:15 +02:00
ubifs
udf udf: Verify partition map count 2025-08-28 16:28:15 +02:00
ufs
unicode
vboxsf
verity
xfs xfs: do not propagate ENODATA disk errors into xattr code 2025-09-04 15:30:29 +02:00
zonefs
Kconfig
Kconfig.binfmt
Makefile
aio.c
anon_inodes.c fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass 2025-07-10 16:03:18 +02:00
attr.c
bad_inode.c
binfmt_elf.c
binfmt_elf_fdpic.c
binfmt_elf_test.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
buffer.c fs/buffer: fix use-after-free when call bh_read() helper 2025-08-28 16:28:44 +02:00
char_dev.c
compat_binfmt_elf.c
coredump.c
d_path.c
dax.c
dcache.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c eventpoll: Fix semi-unbounded recursion 2025-08-28 16:28:12 +02:00
exec.c
fcntl.c
fhandle.c
file.c alloc_fdtable(): change calling conventions. 2025-08-28 16:28:50 +02:00
file_table.c
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-06-19 15:28:43 +02:00
fs-writeback.c fs: writeback: fix use-after-free in __mark_inode_dirty() 2025-09-09 18:56:20 +02:00
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
init.c
inode.c
internal.h
ioctl.c
kernel_read_file.c
libfs.c better lockdep annotations for simple_recursive_removal() 2025-08-28 16:28:15 +02:00
locks.c
mbcache.c
mnt_idmapping.c
mount.h
mpage.c
namei.c
namespace.c use uniform permission checks for all mount propagation changes 2025-08-28 16:28:44 +02:00
nsfs.c
open.c
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
remap_range.c
select.c
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
sync.c
sysctls.c
timerfd.c
userfaultfd.c
utimes.c
xattr.c fs/xattr.c: fix simple_xattr_list() 2025-06-27 11:08:57 +01:00