From f84b525a84855532ce520139730c3bdd2baf21d0 Mon Sep 17 00:00:00 2001 From: Marius Dinu Date: Wed, 18 May 2022 12:28:59 +0300 Subject: [PATCH] ksmbd: fix ipc error and crash Original patch: https://github.com/cifsd-team/ksmbd-tools/issues/227 adapted for ksmbd kernel module v3.4.3 by me. Fixes crash in v3.4.3 only. Use original patch when updating to v3.4.4 as this one will fail hunk #1. Signed-off-by: Marius Dinu --- .../patches/02-ipc-reserved-memory.patch | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 package/kernel/ksmbd/patches/02-ipc-reserved-memory.patch diff --git a/package/kernel/ksmbd/patches/02-ipc-reserved-memory.patch b/package/kernel/ksmbd/patches/02-ipc-reserved-memory.patch new file mode 100644 index 0000000000..478af1e7db --- /dev/null +++ b/package/kernel/ksmbd/patches/02-ipc-reserved-memory.patch @@ -0,0 +1,99 @@ +From 41dbda16a0902798e732abc6599de256b9dc3b27 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Thu, 6 Jan 2022 10:30:31 +0900 +Subject: ksmbd: add reserved room in ipc request/response + +Whenever new parameter is added to smb configuration, It is possible +to break the execution of the IPC daemon by mismatch size of +request/response. This patch tries to reserve space in ipc request/response +in advance to prevent that. + +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +--- + fs/ksmbd/ksmbd_netlink.h | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/ksmbd_netlink.h ++++ b/ksmbd_netlink.h +@@ -103,6 +103,7 @@ struct ksmbd_startup_request { + * we set the SPARSE_FILES bit (0x40). + */ + __u32 sub_auth[3]; /* Subauth value for Security ID */ ++ __u32 reserved[128]; /* Reserved room */ + __u32 ifc_list_sz; /* interfaces list size */ + __s8 ____payload[]; + }; +@@ -113,7 +114,7 @@ struct ksmbd_startup_request { + * IPC request to shutdown ksmbd server. + */ + struct ksmbd_shutdown_request { +- __s32 reserved; ++ __s32 reserved[16]; + }; + + /* +@@ -122,6 +123,7 @@ struct ksmbd_shutdown_request { + struct ksmbd_login_request { + __u32 handle; + __s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */ ++ __u32 reserved[16]; /* Reserved room */ + }; + + /* +@@ -135,6 +137,7 @@ struct ksmbd_login_response { + __u16 status; + __u16 hash_sz; /* hash size */ + __s8 hash[KSMBD_REQ_MAX_HASH_SZ]; /* password hash */ ++ __u32 reserved[16]; /* Reserved room */ + }; + + /* +@@ -143,6 +146,7 @@ struct ksmbd_login_response { + struct ksmbd_share_config_request { + __u32 handle; + __s8 share_name[KSMBD_REQ_MAX_SHARE_NAME]; /* share name */ ++ __u32 reserved[16]; /* Reserved room */ + }; + + /* +@@ -157,6 +161,7 @@ struct ksmbd_share_config_response { + __u16 force_directory_mode; + __u16 force_uid; + __u16 force_gid; ++ __u32 reserved[128]; /* Reserved room */ + __u32 veto_list_sz; + __s8 ____payload[]; + }; +@@ -187,6 +192,7 @@ struct ksmbd_tree_connect_request { + __s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; + __s8 share[KSMBD_REQ_MAX_SHARE_NAME]; + __s8 peer_addr[64]; ++ __u32 reserved[16]; /* Reserved room */ + }; + + /* +@@ -196,6 +202,7 @@ struct ksmbd_tree_connect_response { + __u32 handle; + __u16 status; + __u16 connection_flags; ++ __u32 reserved[16]; /* Reserved room */ + }; + + /* +@@ -204,6 +211,7 @@ struct ksmbd_tree_connect_response { + struct ksmbd_tree_disconnect_request { + __u64 session_id; /* session id */ + __u64 connect_id; /* tree connection id */ ++ __u32 reserved[16]; /* Reserved room */ + }; + + /* +@@ -212,6 +220,7 @@ struct ksmbd_tree_disconnect_request { + struct ksmbd_logout_request { + __s8 account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */ + __u32 account_flags; ++ __u32 reserved[16]; /* Reserved room */ + }; + + /* -- 2.30.2