ksmbd: update to 3.4.6

Release Announcement:
https://github.com/cifsd-team/ksmbd/releases/tag/3.4.6

Remove upstreamed:
- 10-fix-build-on-kernel-5.15.52-or-higher.patch

This fixes the following security bugs:
* CVE-2022-47938, ZDI-22-1689
* CVE-2022-47939, ZDI-22-1690 (patch was already backported before)
* CVE-2022-47940, ZDI-22-1691
* CVE-2022-47941, ZDI-22-1687
* CVE-2022-47942, ZDI-22-1688
* CVE-2022-47943, ZDI-CAN-17817

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 78cbcc77cc33638b185f85c0e40daee1906a2c3c)

diff --git a/package/kernel/ksmbd/Makefile b/package/kernel/ksmbd/Makefile
index 0f796445524165d288c4fb95c6e5ac6cb75fcac8..86207508e54e27284f202d2c0011d865141dc75b 100644 (file)
--- a/package/kernel/ksmbd/Makefile
+++ b/package/kernel/ksmbd/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ksmbd
-PKG_VERSION:=3.4.5
+PKG_VERSION:=3.4.6
 PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/cifsd-team/cifsd/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=2873c8ba1027fc5b04c5f5344804ef1469ad7019a033456c16ca4aa3f2c161f0
+PKG_HASH:=d742992692dbe164060d2a0ea668895ed2b86252f10427db3d3a002df44c445b
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=COPYING

diff --git a/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch b/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch
deleted file mode 100644 (file)
index 0059410..0000000
--- a/package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 1f9d85a340b0d8ff14cf47573417fe84efef9731 Mon Sep 17 00:00:00 2001
-From: Namjae Jeon <linkinjeon@kernel.org>
-Date: Wed, 27 Jul 2022 23:11:47 +0900
-Subject: [PATCH] ksmbd: fix use-after-free bug in smb2_tree_disconect
-
-smb2_tree_disconnect() freed the struct ksmbd_tree_connect,
-but it left the dangling pointer. It can be accessed
-again under compound requests.
-
-This bug can lead an oops looking something link:
-
-[ 1685.468014 ] BUG: KASAN: use-after-free in ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
-[ 1685.468068 ] Read of size 4 at addr ffff888102172180 by task kworker/1:2/4807
-...
-[ 1685.468130 ] Call Trace:
-[ 1685.468132 ]  <TASK>
-[ 1685.468135 ]  dump_stack_lvl+0x49/0x5f
-[ 1685.468141 ]  print_report.cold+0x5e/0x5cf
-[ 1685.468145 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
-[ 1685.468157 ]  kasan_report+0xaa/0x120
-[ 1685.468194 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
-[ 1685.468206 ]  __asan_report_load4_noabort+0x14/0x20
-[ 1685.468210 ]  ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
-[ 1685.468222 ]  smb2_tree_disconnect+0x175/0x250 [ksmbd]
-[ 1685.468235 ]  handle_ksmbd_work+0x30e/0x1020 [ksmbd]
-[ 1685.468247 ]  process_one_work+0x778/0x11c0
-[ 1685.468251 ]  ? _raw_spin_lock_irq+0x8e/0xe0
-[ 1685.468289 ]  worker_thread+0x544/0x1180
-[ 1685.468293 ]  ? __cpuidle_text_end+0x4/0x4
-[ 1685.468297 ]  kthread+0x282/0x320
-[ 1685.468301 ]  ? process_one_work+0x11c0/0x11c0
-[ 1685.468305 ]  ? kthread_complete_and_exit+0x30/0x30
-[ 1685.468309 ]  ret_from_fork+0x1f/0x30
-
-Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17816
-Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
-Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
----
- smb2pdu.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/smb2pdu.c b/smb2pdu.c
-index 15bded43..1396ec49 100644
---- a/smb2pdu.c
-+++ b/smb2pdu.c
-@@ -2059,6 +2059,7 @@ int smb2_tree_disconnect(struct ksmbd_work *work)
- 
-       ksmbd_close_tree_conn_fds(work);
-       ksmbd_tree_conn_disconnect(sess, tcon);
-+      work->tcon = NULL;
-       return 0;
- }
-