diff options
| author | Li Nan <linan122@huawei.com> | 2023-12-08 14:56:47 +0800 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-01-09 12:52:32 -0600 |
| commit | 516b3eb8c8065f7465f87608d37a7ed08298c7a5 (patch) | |
| tree | 8e920f651ea2a05346a7917744fa9d324c394e90 /fs/smb/server | |
| parent | 0dd3ee31125508cd67f7e7172247f05b7fd1753a (diff) | |
| download | linux-516b3eb8c8065f7465f87608d37a7ed08298c7a5.tar.gz linux-516b3eb8c8065f7465f87608d37a7ed08298c7a5.tar.bz2 linux-516b3eb8c8065f7465f87608d37a7ed08298c7a5.zip | |
ksmbd: validate the zero field of packet header
The SMB2 Protocol requires that "The first byte of the Direct TCP
transport packet header MUST be zero (0x00)"[1]. Commit 1c1bcf2d3ea0
("ksmbd: validate smb request protocol id") removed the validation of
this 1-byte zero. Add the validation back now.
[1]: [MS-SMB2] - v20230227, page 30.
https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SMB2/%5bMS-SMB2%5d-230227.pdf
Fixes: 1c1bcf2d3ea0 ("ksmbd: validate smb request protocol id")
Signed-off-by: Li Nan <linan122@huawei.com>
Acked-by: Tom Talpey <tom@talpey.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/server')
| -rw-r--r-- | fs/smb/server/smb_common.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c index 6691ae68af0c..7c98bf699772 100644 --- a/fs/smb/server/smb_common.c +++ b/fs/smb/server/smb_common.c @@ -158,8 +158,12 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work) */ bool ksmbd_smb_request(struct ksmbd_conn *conn) { - __le32 *proto = (__le32 *)smb2_get_msg(conn->request_buf); + __le32 *proto; + if (conn->request_buf[0] != 0) + return false; + + proto = (__le32 *)smb2_get_msg(conn->request_buf); if (*proto == SMB2_COMPRESSION_TRANSFORM_ID) { pr_err_ratelimited("smb2 compression not support yet"); return false; |