Commit f8fbfd85 authored by Christophe JAILLET's avatar Christophe JAILLET Committed by Steve French
Browse files

ksmbd: Fix an error handling path in 'smb2_sess_setup()' 



All the error handling paths of 'smb2_sess_setup()' end to 'out_err'.

All but the new error handling path added by the commit given in the Fixes
tag below.

Fix this error handling path and branch to 'out_err' as well.

Fixes: 0d994cd4 ("ksmbd: add buffer validation in session setup")
Cc: stable@vger.kernel.org # v5.15
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 13605725

fs/ksmbd/smb2pdu.c

+4 −2
Original line number Diff line number Diff line
@@ -1697,8 +1697,10 @@ int smb2_sess_setup(struct ksmbd_work *work) 
	negblob_off = le16_to_cpu(req->SecurityBufferOffset);

	negblob_len = le16_to_cpu(req->SecurityBufferLength);

	if (negblob_off < offsetof(struct smb2_sess_setup_req, Buffer) ||

	    negblob_len < offsetof(struct negotiate_message, NegotiateFlags))

		return -EINVAL;

	    negblob_len < offsetof(struct negotiate_message, NegotiateFlags)) {

		rc = -EINVAL;

		goto out_err;

	}



	negblob = (struct negotiate_message *)((char *)&req->hdr.ProtocolId +

			negblob_off);