From aca915e8475e32edbb33dcb382e78b130cda7080 Mon Sep 17 00:00:00 2001 From: Nick Hainke Date: Fri, 21 Oct 2022 14:23:47 +0200 Subject: [PATCH] ksmbd: update to 3.4.6 Release Announcement: https://github.com/cifsd-team/ksmbd/releases/tag/3.4.6 Remove upstreamed: - 10-fix-build-on-kernel-5.15.52-or-higher.patch This fixes the following security bugs: * CVE-2022-47938, ZDI-22-1689 * CVE-2022-47939, ZDI-22-1690 (patch was already backported before) * CVE-2022-47940, ZDI-22-1691 * CVE-2022-47941, ZDI-22-1687 * CVE-2022-47942, ZDI-22-1688 * CVE-2022-47943, ZDI-CAN-17817 Signed-off-by: Nick Hainke (cherry picked from commit 78cbcc77cc33638b185f85c0e40daee1906a2c3c) --- package/kernel/ksmbd/Makefile | 4 +- .../ksmbd/patches/02-fix_zdi_22_1690.patch | 53 ------------------- 2 files changed, 2 insertions(+), 55 deletions(-) delete mode 100644 package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch diff --git a/package/kernel/ksmbd/Makefile b/package/kernel/ksmbd/Makefile index 0f79644552..86207508e5 100644 --- a/package/kernel/ksmbd/Makefile +++ b/package/kernel/ksmbd/Makefile @@ -1,12 +1,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=ksmbd -PKG_VERSION:=3.4.5 +PKG_VERSION:=3.4.6 PKG_RELEASE:=$(AUTORELEASE) PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://codeload.github.com/cifsd-team/cifsd/tar.gz/$(PKG_VERSION)? -PKG_HASH:=2873c8ba1027fc5b04c5f5344804ef1469ad7019a033456c16ca4aa3f2c161f0 +PKG_HASH:=d742992692dbe164060d2a0ea668895ed2b86252f10427db3d3a002df44c445b PKG_LICENSE:=GPL-2.0-or-later PKG_LICENSE_FILES:=COPYING diff --git a/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch b/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch deleted file mode 100644 index 00594102ca..0000000000 --- a/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 1f9d85a340b0d8ff14cf47573417fe84efef9731 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon -Date: Wed, 27 Jul 2022 23:11:47 +0900 -Subject: [PATCH] ksmbd: fix use-after-free bug in smb2_tree_disconect - -smb2_tree_disconnect() freed the struct ksmbd_tree_connect, -but it left the dangling pointer. It can be accessed -again under compound requests. - -This bug can lead an oops looking something link: - -[ 1685.468014 ] BUG: KASAN: use-after-free in ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468068 ] Read of size 4 at addr ffff888102172180 by task kworker/1:2/4807 -... -[ 1685.468130 ] Call Trace: -[ 1685.468132 ] -[ 1685.468135 ] dump_stack_lvl+0x49/0x5f -[ 1685.468141 ] print_report.cold+0x5e/0x5cf -[ 1685.468145 ] ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468157 ] kasan_report+0xaa/0x120 -[ 1685.468194 ] ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468206 ] __asan_report_load4_noabort+0x14/0x20 -[ 1685.468210 ] ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468222 ] smb2_tree_disconnect+0x175/0x250 [ksmbd] -[ 1685.468235 ] handle_ksmbd_work+0x30e/0x1020 [ksmbd] -[ 1685.468247 ] process_one_work+0x778/0x11c0 -[ 1685.468251 ] ? _raw_spin_lock_irq+0x8e/0xe0 -[ 1685.468289 ] worker_thread+0x544/0x1180 -[ 1685.468293 ] ? __cpuidle_text_end+0x4/0x4 -[ 1685.468297 ] kthread+0x282/0x320 -[ 1685.468301 ] ? process_one_work+0x11c0/0x11c0 -[ 1685.468305 ] ? kthread_complete_and_exit+0x30/0x30 -[ 1685.468309 ] ret_from_fork+0x1f/0x30 - -Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17816 -Reviewed-by: Hyunchul Lee -Signed-off-by: Namjae Jeon ---- - smb2pdu.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/smb2pdu.c b/smb2pdu.c -index 15bded43..1396ec49 100644 ---- a/smb2pdu.c -+++ b/smb2pdu.c -@@ -2059,6 +2059,7 @@ int smb2_tree_disconnect(struct ksmbd_work *work) - - ksmbd_close_tree_conn_fds(work); - ksmbd_tree_conn_disconnect(sess, tcon); -+ work->tcon = NULL; - return 0; - } - -- 2.30.2