• Namjae Jeon's avatar
    ksmbd: unset the binding mark of a reused connection · 78c5a6f1
    Namjae Jeon authored
    Steve French reported null pointer dereference error from sha256 lib.
    cifs.ko can send session setup requests on reused connection.
    If reused connection is used for binding session, conn->binding can
    still remain true and generate_preauth_hash() will not set
    sess->Preauth_HashValue and it will be NULL.
    It is used as a material to create an encryption key in
    ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer
    dereference error from crypto_shash_update().
    
    BUG: kernel NULL pointer dereference, address: 0000000000000000
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 0 P4D 0
    Oops: 0000 [#1] PREEMPT SMP PTI
    CPU: 8 PID: 429254 Comm: kworker/8:39
    Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 )
    Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
    RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]
    <TASK>
    ? show_regs+0x6d/0x80
    ? __die+0x24/0x80
    ? page_fault_oops+0x99/0x1b0
    ? do_user_addr_fault+0x2ee/0x6b0
    ? exc_page_fault+0x83/0x1b0
    ? asm_exc_page_fault+0x27/0x30
    ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]
    ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]
    ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]
    ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]
    _sha256_update+0x77/0xa0 [sha256_ssse3]
    sha256_avx2_update+0x15/0x30 [sha256_ssse3]
    crypto_shash_update+0x1e/0x40
    hmac_update+0x12/0x20
    crypto_shash_update+0x1e/0x40
    generate_key+0x234/0x380 [ksmbd]
    generate_smb3encryptionkey+0x40/0x1c0 [ksmbd]
    ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd]
    ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd]
    smb2_sess_setup+0x952/0xaa0 [ksmbd]
    __process_request+0xa3/0x1d0 [ksmbd]
    __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd]
    handle_ksmbd_work+0x2d/0xa0 [ksmbd]
    process_one_work+0x16c/0x350
    worker_thread+0x306/0x440
    ? __pfx_worker_thread+0x10/0x10
    kthread+0xef/0x120
    ? __pfx_kthread+0x10/0x10
    ret_from_fork+0x44/0x70
    ? __pfx_kthread+0x10/0x10
    ret_from_fork_asm+0x1b/0x30
    </TASK>
    
    Fixes: f5a544e3 ("ksmbd: add support for SMB3 multichannel")
    Cc: stable@vger.kernel.org # v5.15+
    Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
    78c5a6f1
smb2pdu.c 237 KB