Skip to content

Commit bd1886d

Browse files
torvaldstorvalds
committed
Merge tag 'v7.1-rc-part2-ksmbd-fixes' of git://git.samba.org/ksmbd
Pull more smb server updates from Steve French: - move fs/smb/common/smbdirect to fs/smb/smbdirect - change signature calc to use AES-CMAC library, simpler and faster - invalid signature fix - multichannel fix - open create options fix - fix durable handle leak - cap maximum lock count to avoid potential denial of service - four connection fixes: connection free and session destroy IDA fixes, refcount fix, connection leak fix, max_connections off by one fix - IPC validation fix - fix out of bounds write in getting xattrs - fix use after free in durable handle reconnect - three ACL fixes: fix potential ACL overflow, harden num_aces check, and fix minimum ACE size check * tag 'v7.1-rc-part2-ksmbd-fixes' of git://git.samba.org/ksmbd: smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/ smb: server: stop sending fake security descriptors ksmbd: scope conn->binding slowpath to bound sessions only ksmbd: fix CreateOptions sanitization clobbering the whole field ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount ksmbd: destroy async_ida in ksmbd_conn_free() ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() ksmbd: Use AES-CMAC library for SMB3 signature calculation ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment ksmbd: use check_add_overflow() to prevent u16 DACL size overflow ksmbd: fix use-after-free in smb2_open during durable reconnect ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() smb: server: fix max_connections off-by-one in tcp accept path ksmbd: require minimum ACE size in smb_check_perm_dacl() ksmbd: validate response sizes in ipc_validate_msg() smb: server: fix active_num_conn leak on transport allocation failure
2 parents d0ed69f + 1249c01 commit bd1886d

40 files changed

Lines changed: 165 additions & 215 deletions

‎MAINTAINERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24662,7 +24662,7 @@ L: [email protected]
2466224662
L: [email protected] (moderated for non-subscribers)
2466324663
S: Maintained
2466424664
F: fs/smb/client/smbdirect.*
24665-
F: fs/smb/common/smbdirect/
24665+
F: fs/smb/smbdirect/
2466624666
F: fs/smb/server/transport_rdma.*
2466724667

2466824668
SMC91x ETHERNET DRIVER

‎fs/smb/Kconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
source "fs/smb/client/Kconfig"
66
source "fs/smb/server/Kconfig"
7-
source "fs/smb/common/smbdirect/Kconfig"
7+
source "fs/smb/smbdirect/Kconfig"
88

99
config SMBFS
1010
tristate

‎fs/smb/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: GPL-2.0
22

33
obj-$(CONFIG_SMBFS) += common/
4+
obj-$(CONFIG_SMBDIRECT) += smbdirect/
45
obj-$(CONFIG_CIFS) += client/
56
obj-$(CONFIG_SMB_SERVER) += server/

‎fs/smb/client/Kconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ config CIFS_SMB_DIRECT
182182
bool "SMB Direct support"
183183
depends on CIFS && INFINIBAND && INFINIBAND_ADDR_TRANS
184184
depends on CIFS=m || INFINIBAND=y
185-
select SMB_COMMON_SMBDIRECT
185+
select SMBDIRECT
186186
help
187187
Enables SMB Direct support for SMB 3.0, 3.02 and 3.1.1.
188188
SMB Direct allows transferring SMB packets over RDMA. If unsure,

‎fs/smb/client/smbdirect.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
#include "cifs_debug.h"
1010
#include "cifsproto.h"
1111
#include "smb2proto.h"
12-
#include "../common/smbdirect/smbdirect_public.h"
12+
#include "../smbdirect/public.h"
1313

1414
/* Port numbers for SMBD transport */
1515
#define SMB_PORT 445

‎fs/smb/client/smbdirect.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
#include "cifsglob.h"
1414

15-
#include "../common/smbdirect/smbdirect.h"
15+
#include "../smbdirect/smbdirect.h"
1616

1717
extern int rdma_readwrite_threshold;
1818
extern int smbd_max_frmr_depth;

‎fs/smb/common/Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,3 @@
44
#
55

66
obj-$(CONFIG_SMBFS) += cifs_md4.o
7-
obj-$(CONFIG_SMB_COMMON_SMBDIRECT) += smbdirect/

‎fs/smb/common/smbdirect/Makefile‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎fs/smb/server/Kconfig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ config SMB_SERVER
77
select NLS_UTF8
88
select NLS_UCS2_UTILS
99
select CRYPTO
10+
select CRYPTO_LIB_AES_CBC_MACS
1011
select CRYPTO_LIB_ARC4
1112
select CRYPTO_LIB_DES
1213
select CRYPTO_LIB_MD5
1314
select CRYPTO_LIB_SHA256
1415
select CRYPTO_LIB_SHA512
1516
select CRYPTO_LIB_UTILS
16-
select CRYPTO_CMAC
1717
select CRYPTO_AEAD2
1818
select CRYPTO_CCM
1919
select CRYPTO_GCM
@@ -49,7 +49,7 @@ config SMB_SERVER_SMBDIRECT
4949
bool "Support for SMB Direct protocol"
5050
depends on SMB_SERVER && INFINIBAND && INFINIBAND_ADDR_TRANS
5151
depends on SMB_SERVER=m || INFINIBAND=y
52-
select SMB_COMMON_SMBDIRECT
52+
select SMBDIRECT
5353
default n
5454

5555
help

‎fs/smb/server/auth.c‎

Lines changed: 13 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
#include <linux/writeback.h>
1212
#include <linux/uio.h>
1313
#include <linux/xattr.h>
14-
#include <crypto/hash.h>
1514
#include <crypto/aead.h>
15+
#include <crypto/aes-cbc-macs.h>
1616
#include <crypto/md5.h>
1717
#include <crypto/sha2.h>
1818
#include <crypto/utils.h>
@@ -490,46 +490,21 @@ void ksmbd_sign_smb2_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
490490
* @sig: signature value generated for client request packet
491491
*
492492
*/
493-
int ksmbd_sign_smb3_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
494-
int n_vec, char *sig)
493+
void ksmbd_sign_smb3_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
494+
int n_vec, char *sig)
495495
{
496-
struct ksmbd_crypto_ctx *ctx;
497-
int rc, i;
498-
499-
ctx = ksmbd_crypto_ctx_find_cmacaes();
500-
if (!ctx) {
501-
ksmbd_debug(AUTH, "could not crypto alloc cmac\n");
502-
return -ENOMEM;
503-
}
504-
505-
rc = crypto_shash_setkey(CRYPTO_CMACAES_TFM(ctx),
506-
key,
507-
SMB2_CMACAES_SIZE);
508-
if (rc)
509-
goto out;
510-
511-
rc = crypto_shash_init(CRYPTO_CMACAES(ctx));
512-
if (rc) {
513-
ksmbd_debug(AUTH, "cmaces init error %d\n", rc);
514-
goto out;
515-
}
496+
struct aes_cmac_key cmac_key;
497+
struct aes_cmac_ctx cmac_ctx;
498+
int i;
516499

517-
for (i = 0; i < n_vec; i++) {
518-
rc = crypto_shash_update(CRYPTO_CMACAES(ctx),
519-
iov[i].iov_base,
520-
iov[i].iov_len);
521-
if (rc) {
522-
ksmbd_debug(AUTH, "cmaces update error %d\n", rc);
523-
goto out;
524-
}
525-
}
500+
/* This cannot fail, since we always pass a valid key length. */
501+
static_assert(SMB2_CMACAES_SIZE == AES_KEYSIZE_128);
502+
aes_cmac_preparekey(&cmac_key, key, SMB2_CMACAES_SIZE);
526503

527-
rc = crypto_shash_final(CRYPTO_CMACAES(ctx), sig);
528-
if (rc)
529-
ksmbd_debug(AUTH, "cmaces generation error %d\n", rc);
530-
out:
531-
ksmbd_release_crypto_ctx(ctx);
532-
return rc;
504+
aes_cmac_init(&cmac_ctx, &cmac_key);
505+
for (i = 0; i < n_vec; i++)
506+
aes_cmac_update(&cmac_ctx, iov[i].iov_base, iov[i].iov_len);
507+
aes_cmac_final(&cmac_ctx, sig);
533508
}
534509

535510
struct derivation {

0 commit comments

Comments
 (0)