mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-20 09:31:09 +00:00
Code Issues Releases Wiki Activity

ksmbd: Fix wrong return value and message length check in smb2_ioctl()

Browse source 
commit b1763d265a upstream.

Commit c7803b05f7 ("smb3: fix ksmbd bigendian bug in oplock
break, and move its struct to smbfs_common") use the defination
of 'struct validate_negotiate_info_req' in smbfs_common, the
array length of 'Dialects' changed from 1 to 4, but the protocol
does not require the client to send all 4. This lead the request
which satisfied with protocol and server to fail.

So just ensure the request payload has the 'DialectCount' in
smb2_ioctl(), then fsctl_validate_negotiate_info() will use it
to validate the payload length and each dialect.

Also when the {in, out}_buf_len is less than the required, should
goto out to initialize the status in the response header.

Fixes: f7db8fd03a ("ksmbd: add validation in smb2_ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Zhang Xiaoxu 2022-09-26 11:36:30 +08:00 committed by Greg Kroah-Hartman
parent 39b6855628
commit a19f316406
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
fs/ksmbd/smb2pdu.c
View file

@ -7617,11 +7617,16 @@ int smb2_ioctl(struct ksmbd_work *work)
goto out;
}
if (in_buf_len < sizeof(struct validate_negotiate_info_req))
return -EINVAL;
if (in_buf_len < offsetof(struct validate_negotiate_info_req,
Dialects)) {
ret = -EINVAL;
goto out;
}
if (out_buf_len < sizeof(struct validate_negotiate_info_rsp))
return -EINVAL;
if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) {
ret = -EINVAL;
goto out;
}
ret = fsctl_validate_negotiate_info(conn,
(struct validate_negotiate_info_req *)&req->Buffer[0],