Commit a75cb869 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'v7.0-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd 

Pull smb server fixes from Steve French:

 - auth security improvement

 - fix potential buffer overflow in smbdirect negotiation

* tag 'v7.0-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
  ksmbd: Compare MACs in constant time
parents 69062f23 6b4f875a

fs/smb/server/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ config SMB_SERVER 
	select CRYPTO_LIB_MD5

	select CRYPTO_LIB_SHA256

	select CRYPTO_LIB_SHA512

	select CRYPTO_LIB_UTILS

	select CRYPTO_CMAC

	select CRYPTO_AEAD2

	select CRYPTO_CCM

fs/smb/server/auth.c

+3 −1
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
#include <crypto/aead.h>

#include <crypto/md5.h>

#include <crypto/sha2.h>

#include <crypto/utils.h>

#include <linux/random.h>

#include <linux/scatterlist.h>
@@ -165,7 +166,8 @@ int ksmbd_auth_ntlmv2(struct ksmbd_conn *conn, struct ksmbd_session *sess, 
			     ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE,

			     sess->sess_key);



	if (memcmp(ntlmv2->ntlmv2_hash, ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE) != 0)

	if (crypto_memneq(ntlmv2->ntlmv2_hash, ntlmv2_rsp,

			  CIFS_HMAC_MD5_HASH_SIZE))

		return -EINVAL;

	return 0;

}

fs/smb/server/smb2pdu.c

+3 −2
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ 
 *   Copyright (C) 2018 Samsung Electronics Co., Ltd.

 */



#include <crypto/utils.h>

#include <linux/inetdevice.h>

#include <net/addrconf.h>

#include <linux/syscalls.h>
@@ -8880,7 +8881,7 @@ int smb2_check_sign_req(struct ksmbd_work *work) 
	ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, 1,

			    signature);



	if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {

	if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) {

		pr_err("bad smb2 signature\n");

		return 0;

	}
@@ -8968,7 +8969,7 @@ int smb3_check_sign_req(struct ksmbd_work *work) 
	if (ksmbd_sign_smb3_pdu(conn, signing_key, iov, 1, signature))

		return 0;



	if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {

	if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) {

		pr_err("bad smb2 signature\n");

		return 0;

	}

fs/smb/server/transport_rdma.c

+2 −2
Original line number Diff line number Diff line
@@ -2540,9 +2540,9 @@ static int smb_direct_prepare(struct ksmbd_transport *t) 
		goto put;



	req = (struct smbdirect_negotiate_req *)recvmsg->packet;

	sp->max_recv_size = min_t(int, sp->max_recv_size,

	sp->max_recv_size = min_t(u32, sp->max_recv_size,

				  le32_to_cpu(req->preferred_send_size));

	sp->max_send_size = min_t(int, sp->max_send_size,

	sp->max_send_size = min_t(u32, sp->max_send_size,

				  le32_to_cpu(req->max_receive_size));

	sp->max_fragmented_send_size =

		le32_to_cpu(req->max_fragmented_size);