This is a note to let you know that I've just added the patch titled
ksmbd: not allow guest user on multichannel
to the 6.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ksmbd-not-allow-guest-user-on-multichannel.patch
and it can be found in the queue-6.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 3353ab2df5f68dab7da8d5ebb427a2d265a1f2b2 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Date: Wed, 3 May 2023 08:45:08 +0900
Subject: ksmbd: not allow guest user on multichannel
From: Namjae Jeon <linkinjeon@xxxxxxxxxx>
commit 3353ab2df5f68dab7da8d5ebb427a2d265a1f2b2 upstream.
This patch return STATUS_NOT_SUPPORTED if binding session is guest.
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: zdi-disclosures@xxxxxxxxxxxxxx # ZDI-CAN-20480
Signed-off-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ksmbd/smb2pdu.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -1456,7 +1456,7 @@ static int ntlm_authenticate(struct ksmb
* Reuse session if anonymous try to connect
* on reauthetication.
*/
- if (ksmbd_anonymous_user(user)) {
+ if (conn->binding == false && ksmbd_anonymous_user(user)) {
ksmbd_free_user(user);
return 0;
}
@@ -1470,7 +1470,7 @@ static int ntlm_authenticate(struct ksmb
sess->user = user;
}
- if (user_guest(sess->user)) {
+ if (conn->binding == false && user_guest(sess->user)) {
rsp->SessionFlags = SMB2_SESSION_FLAG_IS_GUEST_LE;
} else {
struct authenticate_message *authblob;
@@ -1715,6 +1715,11 @@ int smb2_sess_setup(struct ksmbd_work *w
goto out_err;
}
+ if (user_guest(sess->user)) {
+ rc = -EOPNOTSUPP;
+ goto out_err;
+ }
+
conn->binding = true;
} else if ((conn->dialect < SMB30_PROT_ID ||
server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) &&
@@ -1827,6 +1832,8 @@ out_err:
rsp->hdr.Status = STATUS_NETWORK_SESSION_EXPIRED;
else if (rc == -ENOMEM)
rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES;
+ else if (rc == -EOPNOTSUPP)
+ rsp->hdr.Status = STATUS_NOT_SUPPORTED;
else if (rc)
rsp->hdr.Status = STATUS_LOGON_FAILURE;
Patches currently in stable-queue which might be from linkinjeon@xxxxxxxxxx are
queue-6.2/ksmbd-not-allow-guest-user-on-multichannel.patch
queue-6.2/ksmbd-fix-memleak-in-session-setup.patch
queue-6.2/ksmbd-fix-null-pointer-dereference-in-smb2_get_info_filesystem.patch
queue-6.2/ksmbd-fix-racy-issue-under-cocurrent-smb2-tree-disconnect.patch
queue-6.2/ksmbd-fix-deadlock-in-ksmbd_find_crypto_ctx.patch
queue-6.2/ksmbd-call-rcu_barrier-in-ksmbd_server_exit.patch
