Andrew Lukoshko
b3c4cf07f6
Refresh the dirtyfrag backport to upstream v5 and add the cifs.spnego
hardening patch.
1103-net-skbuff-propagate-shared-frag-marker.patch
Refreshed from upstream v3 to v5
(https://lore.kernel.org/all/ageeJfJHwgzmKXbh@v4bel/). The v5
series adds three hunks on top of v3: two skb_segment() sites
(fold frag_skb-> flags into nskb on the per-iteration flag merge;
fill the marker again when the inner switch rebinds frag_skb on
head_skb-frags exhaustion) and one tcp_clone_payload() site
(carry the marker when building an MTU probe skb from sk_write_queue
frag descriptors). skb_try_coalesce() hunk is retained as in v3/v4
because the upstream commit that dropped it (f84eca581739) is only
partially backported in 6.12 -- its skb_split() half is present,
but the skb_try_coalesce() half is missing.
1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch
Upstream commit 3da1fdf4efbc verbatim. Refuses userspace-created
cifs.spnego keys via request_key(2)/add_key(2); only kernel CIFS
using the private spnego_cred may create them. cifs.upcall
treats the key description as kernel-originating
pid/uid/creduid/upcall_target -- without this fence, userspace
can spoof those fields.
All five patches verified to apply with patch -p1 -F0 against the
6.12.0-211.7.1.el10_2 source tree (no fuzz, no rejects).
67 lines
2.2 KiB
Diff
67 lines
2.2 KiB
Diff
From 3da1fdf4efbc490041eb4f836bf596201203f8f2 Mon Sep 17 00:00:00 2001
|
|
From: Asim Viladi Oglu Manizada <manizada@pm.me>
|
|
Date: Sat, 16 May 2026 21:15:39 +0000
|
|
Subject: smb: client: reject userspace cifs.spnego descriptions
|
|
|
|
cifs.spnego key descriptions contain authority-bearing fields such as
|
|
pid, uid, creduid, and upcall_target that cifs.upcall treats as
|
|
kernel-originating inputs. However, userspace can also create keys of
|
|
this type through request_key(2) or add_key(2), allowing those fields to
|
|
be supplied without CIFS origin.
|
|
|
|
Only accept cifs.spnego descriptions while CIFS is using its private
|
|
spnego_cred to request the key.
|
|
|
|
Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos")
|
|
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
|
|
Reviewed-by: David Howells <dhowells@redhat.com>
|
|
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
|
|
Signed-off-by: Steve French <stfrench@microsoft.com>
|
|
---
|
|
fs/smb/client/cifs_spnego.c | 16 ++++++++++++++++
|
|
1 file changed, 16 insertions(+)
|
|
|
|
diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c
|
|
index 3a41bbada04c76..44c40727568042 100644
|
|
--- a/fs/smb/client/cifs_spnego.c
|
|
+++ b/fs/smb/client/cifs_spnego.c
|
|
@@ -8,6 +8,7 @@
|
|
*/
|
|
|
|
#include <linux/list.h>
|
|
+#include <linux/cred.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/string.h>
|
|
#include <keys/user-type.h>
|
|
@@ -40,12 +41,27 @@ cifs_spnego_key_destroy(struct key *key)
|
|
kfree(key->payload.data[0]);
|
|
}
|
|
|
|
+static int
|
|
+cifs_spnego_key_vet_description(const char *description)
|
|
+{
|
|
+ /*
|
|
+ * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall.
|
|
+ * They are only valid when produced by CIFS while using the private
|
|
+ * spnego_cred installed below. Do not let userspace create this type
|
|
+ * of key through request_key(2)/add_key(2), since the helper treats
|
|
+ * pid/uid/creduid/upcall_target as kernel-originating fields.
|
|
+ */
|
|
+ if (current_cred() != spnego_cred)
|
|
+ return -EPERM;
|
|
+ return 0;
|
|
+}
|
|
|
|
/*
|
|
* keytype for CIFS spnego keys
|
|
*/
|
|
struct key_type cifs_spnego_key_type = {
|
|
.name = "cifs.spnego",
|
|
+ .vet_description = cifs_spnego_key_vet_description,
|
|
.instantiate = cifs_spnego_key_instantiate,
|
|
.destroy = cifs_spnego_key_destroy,
|
|
.describe = user_describe,
|
|
--
|
|
cgit 1.3-korg
|
|
|