Commit 8cb6fc323150 for kernel

commit 8cb6fc3231500233ddaf63cb7fd5435008d9ed5f
Author: Piyush Sachdeva <s.piyush1024@gmail.com>
Date:   Thu May 7 22:22:14 2026 +0530

    smb: client: Zero-pad short GSS session keys per MS-SMB2

    Per MS-SMB2 section 3.2.5.3, Session.SessionKey is the first 16 bytes
    of the GSS cryptographic key, right-padded with zero bytes if the key
    is shorter than 16 bytes.

    SMB2_auth_kerberos() copies the GSS session key from the cifs.upcall
    response using kmemdup(msg->data, msg->sesskey_len, ...) and stores
    the GSS-reported length verbatim in ses->auth_key.len. generate_key()
    reads SMB2_NTLMV2_SESSKEY_SIZE bytes from this buffer when feeding the
    HMAC-SHA256 KDF for signing key derivation. If a GSS mechanism returns
    a session key shorter than 16 bytes (e.g. a deprecated single-DES
    Kerberos enctype with an 8-byte session key), the KDF call performs an
    out-of-bounds slab read and derives keys that do not match the server,
    which pads per the spec.

    Modern KDCs disable short-key enctypes by default, so this is latent
    rather than reachable in production, but it is still a kernel heap
    over-read.

    Allocate auth_key.response with kzalloc() at a length of
    max(msg->sesskey_len, SMB2_NTLMV2_SESSKEY_SIZE), copy the GSS key in,
    and rely on kzalloc()'s zero initialization for the spec-mandated
    padding. Set ses->auth_key.len to the padded length. Larger GSS keys
    (e.g. the 32-byte aes256-cts-hmac-sha1-96 session key) continue to be
    stored at their natural length, preserving the FullSessionKey path.

    Emit a cifs_dbg(VFS, ...) message when a short key is encountered to
    surface deprecated-enctype usage.

    NTLMv2 and NTLMSSP code paths produce a 16-byte session key by
    construction and are unaffected.

    Signed-off-by: Piyush Sachdeva <psachdeva@microsoft.com>
    Signed-off-by: Piyush Sachdeva <s.piyush1024@gmail.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index cb61051f9af3..995fcdd30681 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -1713,17 +1713,30 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
 	is_binding = (ses->ses_status == SES_GOOD);
 	spin_unlock(&ses->ses_lock);

+	/*
+	 * Per MS-SMB2 3.2.5.3, Session.SessionKey is the first 16 bytes of the
+	 * GSS cryptographic key, right-padded with zero bytes if shorter.
+	 * Allocate at least SMB2_NTLMV2_SESSKEY_SIZE bytes (zeroed) so the KDF
+	 * input buffer is always valid for HMAC-SHA256 even with deprecated
+	 * Kerberos enctypes that return a short session key.
+	 */
+	if (unlikely(msg->sesskey_len < SMB2_NTLMV2_SESSKEY_SIZE))
+		cifs_dbg(VFS,
+			 "short GSS session key (%u bytes); zero-padding per MS-SMB2 3.2.5.3\n",
+			 msg->sesskey_len);
+
 	kfree_sensitive(ses->auth_key.response);
-	ses->auth_key.response = kmemdup(msg->data,
-					 msg->sesskey_len,
-					 GFP_KERNEL);
+	ses->auth_key.len = max_t(unsigned int, msg->sesskey_len,
+				  SMB2_NTLMV2_SESSKEY_SIZE);
+	ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL);
 	if (!ses->auth_key.response) {
 		cifs_dbg(VFS, "%s: can't allocate (%u bytes) memory\n",
-			 __func__, msg->sesskey_len);
+			 __func__, ses->auth_key.len);
+		ses->auth_key.len = 0;
 		rc = -ENOMEM;
 		goto out_put_spnego_key;
 	}
-	ses->auth_key.len = msg->sesskey_len;
+	memcpy(ses->auth_key.response, msg->data, msg->sesskey_len);

 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
 	sess_data->iov[1].iov_len = msg->secblob_len;