Merge tag '6.6-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd

9f3ebbef · Linus Torvalds <[email protected]> · 2023-09-29 16:51:38 -07:00

Pull smb server fixes from Steve French:
 "Two SMB3 server fixes for null pointer dereferences:

   - invalid SMB3 request case (fixes issue found in testing the read
     compound patch)

   - iovec error case in response processing"

* tag '6.6-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: check iov vector index in ksmbd_conn_write()
  ksmbd: return invalid parameter error response if smb2 request is invalid

Commit: 9f3ebbef746f89f860a90ced99a359202ea86fde
Parents: 14c06b91 · 73f949ea

Merge commit. Changes below are compared with the first parent: 14c06b91.

Changes

3 files changed · +7 −4

File	Status	Add	Del	Content
fs/smb/server/connection.c	modified	+3	−0	View file
fs/smb/server/server.c	modified	+3	−1	View file
fs/smb/server/smb2misc.c	modified	+1	−3	View file

fs/smb/server/connection.c

View file

diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index 0d990c2..db7fa70 100644
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -197,6 +197,9 @@ int ksmbd_conn_write(struct ksmbd_work *work)
 	if (work->send_no_response)
 		return 0;
 
+	if (!work->iov_idx)
+		return -EINVAL;
+
 	ksmbd_conn_lock(conn);
 	sent = conn->transport->ops->writev(conn->transport, work->iov,
 			work->iov_cnt,

fs/smb/server/server.c

View file

diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 5ab2f52..32347fe 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -115,8 +115,10 @@ static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
 	if (check_conn_state(work))
 		return SERVER_HANDLER_CONTINUE;
 
-	if (ksmbd_verify_smb_message(work))
+	if (ksmbd_verify_smb_message(work)) {
+		conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
 		return SERVER_HANDLER_ABORT;
+	}
 
 	command = conn->ops->get_cmd_val(work);
 	*cmd = command;

fs/smb/server/smb2misc.c

View file

diff --git a/fs/smb/server/smb2misc.c b/fs/smb/server/smb2misc.c
index e881df1..23bd3d1 100644
--- a/fs/smb/server/smb2misc.c
+++ b/fs/smb/server/smb2misc.c
@@ -440,10 +440,8 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work)
 
 validate_credit:
 	if ((work->conn->vals->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU) &&
-	    smb2_validate_credit_charge(work->conn, hdr)) {
-		work->conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
+	    smb2_validate_credit_charge(work->conn, hdr))
 		return 1;
-	}
 
 	return 0;
 }