diff options
| author | Nick Hainke <vincent@systemli.org> | 2022-10-21 14:23:47 +0200 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2023-01-07 16:22:15 +0100 |
| commit | aca915e8475e32edbb33dcb382e78b130cda7080 (patch) | |
| tree | 4b171ced4098f92caf64b5422fd92b7112073d05 /package | |
| parent | 4b7f9e42e2bff91d8eec2f195d0bb3bb6f6c43e2 (diff) | |
| download | upstream-aca915e8475e32edbb33dcb382e78b130cda7080.tar.gz upstream-aca915e8475e32edbb33dcb382e78b130cda7080.tar.bz2 upstream-aca915e8475e32edbb33dcb382e78b130cda7080.zip | |
ksmbd: update to 3.4.6
Release Announcement:
https://github.com/cifsd-team/ksmbd/releases/tag/3.4.6
Remove upstreamed:
- 10-fix-build-on-kernel-5.15.52-or-higher.patch
This fixes the following security bugs:
* CVE-2022-47938, ZDI-22-1689
* CVE-2022-47939, ZDI-22-1690 (patch was already backported before)
* CVE-2022-47940, ZDI-22-1691
* CVE-2022-47941, ZDI-22-1687
* CVE-2022-47942, ZDI-22-1688
* CVE-2022-47943, ZDI-CAN-17817
Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 78cbcc77cc33638b185f85c0e40daee1906a2c3c)
Diffstat (limited to 'package')
| -rw-r--r-- | package/kernel/ksmbd/Makefile | 4 | ||||
| -rw-r--r-- | package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch | 53 |
2 files changed, 2 insertions, 55 deletions
diff --git a/package/kernel/ksmbd/Makefile b/package/kernel/ksmbd/Makefile index 0f79644552..86207508e5 100644 --- a/package/kernel/ksmbd/Makefile +++ b/package/kernel/ksmbd/Makefile @@ -1,12 +1,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=ksmbd -PKG_VERSION:=3.4.5 +PKG_VERSION:=3.4.6 PKG_RELEASE:=$(AUTORELEASE) PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://codeload.github.com/cifsd-team/cifsd/tar.gz/$(PKG_VERSION)? -PKG_HASH:=2873c8ba1027fc5b04c5f5344804ef1469ad7019a033456c16ca4aa3f2c161f0 +PKG_HASH:=d742992692dbe164060d2a0ea668895ed2b86252f10427db3d3a002df44c445b PKG_LICENSE:=GPL-2.0-or-later PKG_LICENSE_FILES:=COPYING diff --git a/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch b/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch deleted file mode 100644 index 00594102ca..0000000000 --- a/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 1f9d85a340b0d8ff14cf47573417fe84efef9731 Mon Sep 17 00:00:00 2001 -From: Namjae Jeon <linkinjeon@kernel.org> -Date: Wed, 27 Jul 2022 23:11:47 +0900 -Subject: [PATCH] ksmbd: fix use-after-free bug in smb2_tree_disconect - -smb2_tree_disconnect() freed the struct ksmbd_tree_connect, -but it left the dangling pointer. It can be accessed -again under compound requests. - -This bug can lead an oops looking something link: - -[ 1685.468014 ] BUG: KASAN: use-after-free in ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468068 ] Read of size 4 at addr ffff888102172180 by task kworker/1:2/4807 -... -[ 1685.468130 ] Call Trace: -[ 1685.468132 ] <TASK> -[ 1685.468135 ] dump_stack_lvl+0x49/0x5f -[ 1685.468141 ] print_report.cold+0x5e/0x5cf -[ 1685.468145 ] ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468157 ] kasan_report+0xaa/0x120 -[ 1685.468194 ] ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468206 ] __asan_report_load4_noabort+0x14/0x20 -[ 1685.468210 ] ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] -[ 1685.468222 ] smb2_tree_disconnect+0x175/0x250 [ksmbd] -[ 1685.468235 ] handle_ksmbd_work+0x30e/0x1020 [ksmbd] -[ 1685.468247 ] process_one_work+0x778/0x11c0 -[ 1685.468251 ] ? _raw_spin_lock_irq+0x8e/0xe0 -[ 1685.468289 ] worker_thread+0x544/0x1180 -[ 1685.468293 ] ? __cpuidle_text_end+0x4/0x4 -[ 1685.468297 ] kthread+0x282/0x320 -[ 1685.468301 ] ? process_one_work+0x11c0/0x11c0 -[ 1685.468305 ] ? kthread_complete_and_exit+0x30/0x30 -[ 1685.468309 ] ret_from_fork+0x1f/0x30 - -Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17816 -Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> -Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> ---- - smb2pdu.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/smb2pdu.c b/smb2pdu.c -index 15bded43..1396ec49 100644 ---- a/smb2pdu.c -+++ b/smb2pdu.c -@@ -2059,6 +2059,7 @@ int smb2_tree_disconnect(struct ksmbd_work *work) - - ksmbd_close_tree_conn_fds(work); - ksmbd_tree_conn_disconnect(sess, tcon); -+ work->tcon = NULL; - return 0; - } - |