Skip to contentSkip to conversation

FAILED: patch "[PATCH] SMB311: Improve checking of negotiate security contexts" failed to apply to 4.16-stable tree

PATCH [email protected] 1 participant 1 message Apr 20, 2018 Stable branch

lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.16-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From 5100d8a3fe034845926266a4e7f5bdcbb859088b Mon Sep 17 00:00:00 2001

From: Steve French <[email protected]>
Date: Mon, 9 Apr 2018 10:47:14 -0500
Subject: [PATCH] SMB311: Improve checking of negotiate security contexts

SMB3.11 crypto and hash contexts were not being checked strictly enough. Add parsing and validity checking for the security contexts in the SMB3.11 negotiate response.

Signed-off-by Steve French <[email protected]>
CC Stable <[email protected]>
Reviewed-by Pavel Shilovsky <[email protected]>
fs/cifs/cifsglob.h +1 -0
index 2282562e78a1..56fee0330afc 100644
@@ -676,6 +676,7 @@ struct TCP_Server_Info {
 	unsigned int	max_read;
 	unsigned int	max_write;
 #ifdef CONFIG_CIFS_SMB311
+	__le16	cipher_type;
 	 /* save initital negprot hash */
 	__u8	preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE];
 #endif /* 3.1.1 */
fs/cifs/smb2pdu.c +102 -0

114 lines not on this page · raw message

fs/cifs/smb2pdu.h +3 -0
index 0e0a0af89e4d..6093e5142b2b 100644
@@ -275,6 +275,7 @@ struct smb2_neg_context {
 #define SMB2_PREAUTH_INTEGRITY_SHA512	cpu_to_le16(0x0001)
 #define SMB2_PREAUTH_HASH_SIZE 64
 
+#define MIN_PREAUTH_CTXT_DATA_LEN	(SMB311_SALT_SIZE + 6)
 struct smb2_preauth_neg_context {
 	__le16	ContextType; /* 1 */
 	__le16	DataLength;

@@ -289,6 +290,8 @@ struct smb2_preauth_neg_context {
 #define SMB2_ENCRYPTION_AES128_CCM	cpu_to_le16(0x0001)
 #define SMB2_ENCRYPTION_AES128_GCM	cpu_to_le16(0x0002)
 
+/* Min encrypt context data is one cipher so 2 bytes + 2 byte count field */
+#define MIN_ENCRYPT_CTXT_DATA_LEN	4
 struct smb2_encryption_neg_context {
 	__le16	ContextType; /* 2 */
 	__le16	DataLength;