Skip to content

Commit 5aa4fda

Browse files
Long Lismfrench
authored andcommitted
ksmbd: validate command request size
In commit 2b9b8f3 ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands. Cc: [email protected] Fixes: 2b9b8f3 ("ksmbd: validate command payload size") Acked-by: Namjae Jeon <[email protected]> Signed-off-by: Long Li <[email protected]> Signed-off-by: Steve French <[email protected]>
1 parent 5d0c230 commit 5aa4fda

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

fs/smb/server/smb2misc.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -380,13 +380,13 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work)
380380
}
381381

382382
if (smb2_req_struct_sizes[command] != pdu->StructureSize2) {
383-
if (command == SMB2_OPLOCK_BREAK_HE &&
384-
le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_20 &&
385-
le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_21) {
383+
if (!(command == SMB2_OPLOCK_BREAK_HE &&
384+
(le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_20 ||
385+
le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_21))) {
386386
/* special case for SMB2.1 lease break message */
387387
ksmbd_debug(SMB,
388-
"Illegal request size %d for oplock break\n",
389-
le16_to_cpu(pdu->StructureSize2));
388+
"Illegal request size %u for command %d\n",
389+
le16_to_cpu(pdu->StructureSize2), command);
390390
return 1;
391391
}
392392
}

0 commit comments

Comments
 (0)