| Message ID | 20220914021741.2672982-3-zhangxiaoxu5@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | Fix some bug in FSCTL_VALIDATE_NEGOTIATE_INFO handler | expand |
On 9/13/2022 7:17 PM, Zhang Xiaoxu wrote: > When the {in, out}_buf_len is less than the required, should goto out > to initialize the status in the response header. > > Fixes: f7db8fd03a4bc ("ksmbd: add validation in smb2_ioctl") > Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> > Cc: <stable@vger.kernel.org> > --- > fs/ksmbd/smb2pdu.c | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) > > diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c > index c49f65146ab3..b56d7688ccf1 100644 > --- a/fs/ksmbd/smb2pdu.c > +++ b/fs/ksmbd/smb2pdu.c > @@ -7640,11 +7640,15 @@ int smb2_ioctl(struct ksmbd_work *work) > goto out; > } > > - if (in_buf_len < sizeof(struct validate_negotiate_info_req)) > - return -EINVAL; > + if (in_buf_len < sizeof(struct validate_negotiate_info_req)) { > + ret = -EINVAL; > + goto out; > + } In itself, this doesn't really fix the problem of requiring 4 dialects, because it's still comparing to the incorrect Dialects[4] size. It's only a fix once the 3/5 patch is applied. So, I don't think it's appropriate for stable. If you squash 2 and 3, then ok. Tom. > - if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) > - return -EINVAL; > + if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) { > + ret = -EINVAL; > + goto out; > + } > > ret = fsctl_validate_negotiate_info(conn, > (struct validate_negotiate_info_req *)&req->Buffer[0],
diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index c49f65146ab3..b56d7688ccf1 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -7640,11 +7640,15 @@ int smb2_ioctl(struct ksmbd_work *work) goto out; } - if (in_buf_len < sizeof(struct validate_negotiate_info_req)) - return -EINVAL; + if (in_buf_len < sizeof(struct validate_negotiate_info_req)) { + ret = -EINVAL; + goto out; + } - if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) - return -EINVAL; + if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) { + ret = -EINVAL; + goto out; + } ret = fsctl_validate_negotiate_info(conn, (struct validate_negotiate_info_req *)&req->Buffer[0],
When the {in, out}_buf_len is less than the required, should goto out to initialize the status in the response header. Fixes: f7db8fd03a4bc ("ksmbd: add validation in smb2_ioctl") Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> Cc: <stable@vger.kernel.org> --- fs/ksmbd/smb2pdu.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)