Commit 4227f811 authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: fix transform header validation 



Validate that the transform and smb request headers are present
before checking OriginalMessageSize and SessionId fields.

Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Ralph Böhme <slow@samba.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: default avatarTom Talpey <tom@talpey.com>
Acked-by: default avatarHyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 8f77150c

fs/ksmbd/smb2pdu.c

+9 −9
Original line number Diff line number Diff line
@@ -8414,16 +8414,8 @@ int smb3_decrypt_req(struct ksmbd_work *work) 
	unsigned int buf_data_size = pdu_length + 4 -

		sizeof(struct smb2_transform_hdr);

	struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)buf;

	unsigned int orig_len = le32_to_cpu(tr_hdr->OriginalMessageSize);

	int rc = 0;



	sess = ksmbd_session_lookup_all(conn, le64_to_cpu(tr_hdr->SessionId));

	if (!sess) {

		pr_err("invalid session id(%llx) in transform header\n",

		       le64_to_cpu(tr_hdr->SessionId));

		return -ECONNABORTED;

	}



	if (pdu_length + 4 <

	    sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr)) {

		pr_err("Transform message is too small (%u)\n",
@@ -8431,11 +8423,19 @@ int smb3_decrypt_req(struct ksmbd_work *work) 
		return -ECONNABORTED;

	}



	if (pdu_length + 4 < orig_len + sizeof(struct smb2_transform_hdr)) {

	if (pdu_length + 4 <

	    le32_to_cpu(tr_hdr->OriginalMessageSize) + sizeof(struct smb2_transform_hdr)) {

		pr_err("Transform message is broken\n");

		return -ECONNABORTED;

	}



	sess = ksmbd_session_lookup_all(conn, le64_to_cpu(tr_hdr->SessionId));

	if (!sess) {

		pr_err("invalid session id(%llx) in transform header\n",

		       le64_to_cpu(tr_hdr->SessionId));

		return -ECONNABORTED;

	}



	iov[0].iov_base = buf;

	iov[0].iov_len = sizeof(struct smb2_transform_hdr);

	iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr);