| From 6d7cb549c2ca20e1f07593f15e936fd54b763028 Mon Sep 17 00:00:00 2001 |
| From: Namjae Jeon <linkinjeon@kernel.org> |
| Date: Wed, 3 May 2023 08:26:45 +0900 |
| Subject: ksmbd: fix memleak in session setup |
| |
| From: Namjae Jeon <linkinjeon@kernel.org> |
| |
| commit 6d7cb549c2ca20e1f07593f15e936fd54b763028 upstream. |
| |
| If client send session setup request with unknown NTLMSSP message type, |
| session that does not included channel can be created. It will cause |
| session memleak. because ksmbd_sessions_deregister() does not destroy |
| session if channel is not included. This patch return error response if |
| client send the request unknown NTLMSSP message type. |
| |
| Cc: stable@vger.kernel.org |
| Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20593 |
| Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> |
| Signed-off-by: Steve French <stfrench@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| fs/ksmbd/smb2pdu.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| --- a/fs/ksmbd/smb2pdu.c |
| +++ b/fs/ksmbd/smb2pdu.c |
| @@ -1801,6 +1801,10 @@ int smb2_sess_setup(struct ksmbd_work *w |
| } |
| kfree(sess->Preauth_HashValue); |
| sess->Preauth_HashValue = NULL; |
| + } else { |
| + pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", |
| + le32_to_cpu(negblob->MessageType)); |
| + rc = -EINVAL; |
| } |
| } else { |
| /* TODO: need one more negotiation */ |
