@@ -8424,13 +8424,13 @@ void smb3_preauth_hash_rsp(struct ksmbd_work *work)
84248424 }
84258425}
84268426
8427- static void fill_transform_hdr (struct smb2_transform_hdr * tr_hdr , char * old_buf ,
8428- __le16 cipher_type )
8427+ static void fill_transform_hdr (void * tr_buf , char * old_buf , __le16 cipher_type )
84298428{
8430- struct smb2_hdr * hdr = (struct smb2_hdr * )old_buf ;
8429+ struct smb2_transform_hdr * tr_hdr = tr_buf + 4 ;
8430+ struct smb2_hdr * hdr = smb2_get_msg (old_buf );
84318431 unsigned int orig_len = get_rfc1002_len (old_buf );
84328432
8433- memset (tr_hdr , 0 , sizeof (struct smb2_transform_hdr ));
8433+ memset (tr_buf , 0 , sizeof (struct smb2_transform_hdr ) + 4 );
84348434 tr_hdr -> ProtocolId = SMB2_TRANSFORM_PROTO_NUM ;
84358435 tr_hdr -> OriginalMessageSize = cpu_to_le32 (orig_len );
84368436 tr_hdr -> Flags = cpu_to_le16 (0x01 );
@@ -8440,30 +8440,29 @@ static void fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, char *old_buf,
84408440 else
84418441 get_random_bytes (& tr_hdr -> Nonce , SMB3_AES_CCM_NONCE );
84428442 memcpy (& tr_hdr -> SessionId , & hdr -> SessionId , 8 );
8443- inc_rfc1001_len (tr_hdr , sizeof (struct smb2_transform_hdr ) - 4 );
8444- inc_rfc1001_len (tr_hdr , orig_len );
8443+ inc_rfc1001_len (tr_buf , sizeof (struct smb2_transform_hdr ));
8444+ inc_rfc1001_len (tr_buf , orig_len );
84458445}
84468446
84478447int smb3_encrypt_resp (struct ksmbd_work * work )
84488448{
84498449 char * buf = work -> response_buf ;
8450- struct smb2_transform_hdr * tr_hdr ;
84518450 struct kvec iov [3 ];
84528451 int rc = - ENOMEM ;
84538452 int buf_size = 0 , rq_nvec = 2 + (work -> aux_payload_sz ? 1 : 0 );
84548453
84558454 if (ARRAY_SIZE (iov ) < rq_nvec )
84568455 return - ENOMEM ;
84578456
8458- tr_hdr = kzalloc (sizeof (struct smb2_transform_hdr ), GFP_KERNEL );
8459- if (!tr_hdr )
8457+ work -> tr_buf = kzalloc (sizeof (struct smb2_transform_hdr ) + 4 , GFP_KERNEL );
8458+ if (!work -> tr_buf )
84608459 return rc ;
84618460
84628461 /* fill transform header */
8463- fill_transform_hdr (tr_hdr , buf , work -> conn -> cipher_type );
8462+ fill_transform_hdr (work -> tr_buf , buf , work -> conn -> cipher_type );
84648463
8465- iov [0 ].iov_base = tr_hdr ;
8466- iov [0 ].iov_len = sizeof (struct smb2_transform_hdr );
8464+ iov [0 ].iov_base = work -> tr_buf ;
8465+ iov [0 ].iov_len = sizeof (struct smb2_transform_hdr ) + 4 ;
84678466 buf_size += iov [0 ].iov_len - 4 ;
84688467
84698468 iov [1 ].iov_base = buf + 4 ;
@@ -8483,15 +8482,14 @@ int smb3_encrypt_resp(struct ksmbd_work *work)
84838482 return rc ;
84848483
84858484 memmove (buf , iov [1 ].iov_base , iov [1 ].iov_len );
8486- tr_hdr -> smb2_buf_length = cpu_to_be32 (buf_size );
8487- work -> tr_buf = tr_hdr ;
8485+ * (__be32 * )work -> tr_buf = cpu_to_be32 (buf_size );
84888486
84898487 return rc ;
84908488}
84918489
84928490bool smb3_is_transform_hdr (void * buf )
84938491{
8494- struct smb2_transform_hdr * trhdr = buf ;
8492+ struct smb2_transform_hdr * trhdr = smb2_get_msg ( buf ) ;
84958493
84968494 return trhdr -> ProtocolId == SMB2_TRANSFORM_PROTO_NUM ;
84978495}
@@ -8503,9 +8501,8 @@ int smb3_decrypt_req(struct ksmbd_work *work)
85038501 char * buf = work -> request_buf ;
85048502 unsigned int pdu_length = get_rfc1002_len (buf );
85058503 struct kvec iov [2 ];
8506- int buf_data_size = pdu_length + 4 -
8507- sizeof (struct smb2_transform_hdr );
8508- struct smb2_transform_hdr * tr_hdr = (struct smb2_transform_hdr * )buf ;
8504+ int buf_data_size = pdu_length - sizeof (struct smb2_transform_hdr );
8505+ struct smb2_transform_hdr * tr_hdr = smb2_get_msg (buf );
85098506 int rc = 0 ;
85108507
85118508 if (buf_data_size < sizeof (struct smb2_hdr )) {
@@ -8527,8 +8524,8 @@ int smb3_decrypt_req(struct ksmbd_work *work)
85278524 }
85288525
85298526 iov [0 ].iov_base = buf ;
8530- iov [0 ].iov_len = sizeof (struct smb2_transform_hdr );
8531- iov [1 ].iov_base = buf + sizeof (struct smb2_transform_hdr );
8527+ iov [0 ].iov_len = sizeof (struct smb2_transform_hdr ) + 4 ;
8528+ iov [1 ].iov_base = buf + sizeof (struct smb2_transform_hdr ) + 4 ;
85328529 iov [1 ].iov_len = buf_data_size ;
85338530 rc = ksmbd_crypt_message (conn , iov , 2 , 0 );
85348531 if (rc )
0 commit comments