mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 05:44:11 +00:00
ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length
ksmbd allowed the actual frame length to be smaller than the rfc1002
length. If allowed, it is possible to allocates a large amount of memory
that can be limited by credit management and can eventually cause memory
exhaustion problem. This patch do not allow it except SMB2 Negotiate
request which will be validated when message handling proceeds.
Also, Allow a message that padded to 8byte boundary.
Fixes: e2f34481b2
("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
parent
8f8c43b125
commit
fb533473d1
1 changed files with 10 additions and 11 deletions
|
@ -408,20 +408,19 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work)
|
||||||
goto validate_credit;
|
goto validate_credit;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* windows client also pad up to 8 bytes when compounding.
|
* SMB2 NEGOTIATE request will be validated when message
|
||||||
* If pad is longer than eight bytes, log the server behavior
|
* handling proceeds.
|
||||||
* (once), since may indicate a problem but allow it and
|
|
||||||
* continue since the frame is parseable.
|
|
||||||
*/
|
*/
|
||||||
if (clc_len < len) {
|
if (command == SMB2_NEGOTIATE_HE)
|
||||||
ksmbd_debug(SMB,
|
|
||||||
"cli req padded more than expected. Length %d not %d for cmd:%d mid:%llu\n",
|
|
||||||
len, clc_len, command,
|
|
||||||
le64_to_cpu(hdr->MessageId));
|
|
||||||
goto validate_credit;
|
goto validate_credit;
|
||||||
}
|
|
||||||
|
|
||||||
ksmbd_debug(SMB,
|
/*
|
||||||
|
* Allow a message that padded to 8byte boundary.
|
||||||
|
*/
|
||||||
|
if (clc_len < len && (len - clc_len) < 8)
|
||||||
|
goto validate_credit;
|
||||||
|
|
||||||
|
pr_err_ratelimited(
|
||||||
"cli req too short, len %d not %d. cmd:%d mid:%llu\n",
|
"cli req too short, len %d not %d. cmd:%d mid:%llu\n",
|
||||||
len, clc_len, command,
|
len, clc_len, command,
|
||||||
le64_to_cpu(hdr->MessageId));
|
le64_to_cpu(hdr->MessageId));
|
||||||
|
|
Loading…
Reference in a new issue