Skip to content

Commit e2cc644

Browse files
torvaldstorvalds
committed
Merge tag 'v6.19-rc2-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French: - Fix parsing of SMB1 negotiate request by adjusting offsets affected by the removal of the RFC1002 length field from the SMB header - Update minimum PDU size macros for both SMB1 and SMB2 - Rename smb2_get_msg function to smb_get_msg to better reflect its role in handling both SMB1 and SMB2 requests * tag 'v6.19-rc2-smb3-server-fixes' of git://git.samba.org/ksmbd: smb/server: fix minimum SMB2 PDU size smb/server: fix minimum SMB1 PDU size ksmbd: rename smb2_get_msg to smb_get_msg ksmbd: Fix to handle removal of rfc1002 header from smb_hdr
2 parents ccd1cdc + 4c7d8eb commit e2cc644

8 files changed

Lines changed: 70 additions & 69 deletions

File tree

‎fs/smb/server/auth.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -714,7 +714,7 @@ void ksmbd_gen_smb311_encryptionkey(struct ksmbd_conn *conn,
714714
int ksmbd_gen_preauth_integrity_hash(struct ksmbd_conn *conn, char *buf,
715715
__u8 *pi_hash)
716716
{
717-
struct smb2_hdr *rcv_hdr = smb2_get_msg(buf);
717+
struct smb2_hdr *rcv_hdr = smb_get_msg(buf);
718718
char *all_bytes_msg = (char *)&rcv_hdr->ProtocolId;
719719
int msg_size = get_rfc1002_len(buf);
720720
struct sha512_ctx sha_ctx;
@@ -841,7 +841,7 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,
841841
unsigned int nvec, int enc)
842842
{
843843
struct ksmbd_conn *conn = work->conn;
844-
struct smb2_transform_hdr *tr_hdr = smb2_get_msg(iov[0].iov_base);
844+
struct smb2_transform_hdr *tr_hdr = smb_get_msg(iov[0].iov_base);
845845
unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 20;
846846
int rc;
847847
struct scatterlist *sg;

‎fs/smb/server/connection.c‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -295,8 +295,9 @@ bool ksmbd_conn_alive(struct ksmbd_conn *conn)
295295
return true;
296296
}
297297

298-
#define SMB1_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb_hdr))
299-
#define SMB2_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb2_hdr) + 4)
298+
/* "+2" for BCC field (ByteCount, 2 bytes) */
299+
#define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2)
300+
#define SMB2_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb2_pdu))
300301

301302
/**
302303
* ksmbd_conn_handler_loop() - session thread to listen on new smb requests
@@ -363,7 +364,7 @@ int ksmbd_conn_handler_loop(void *p)
363364
if (pdu_size > MAX_STREAM_PROT_LEN)
364365
break;
365366

366-
if (pdu_size < SMB1_MIN_SUPPORTED_HEADER_SIZE)
367+
if (pdu_size < SMB1_MIN_SUPPORTED_PDU_SIZE)
367368
break;
368369

369370
/* 4 for rfc1002 length field */
@@ -394,9 +395,9 @@ int ksmbd_conn_handler_loop(void *p)
394395
if (!ksmbd_smb_request(conn))
395396
break;
396397

397-
if (((struct smb2_hdr *)smb2_get_msg(conn->request_buf))->ProtocolId ==
398+
if (((struct smb2_hdr *)smb_get_msg(conn->request_buf))->ProtocolId ==
398399
SMB2_PROTO_NUMBER) {
399-
if (pdu_size < SMB2_MIN_SUPPORTED_HEADER_SIZE)
400+
if (pdu_size < SMB2_MIN_SUPPORTED_PDU_SIZE)
400401
break;
401402
}
402403

‎fs/smb/server/oplock.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -637,7 +637,7 @@ static void __smb2_oplock_break_noti(struct work_struct *wk)
637637
goto out;
638638
}
639639

640-
rsp_hdr = smb2_get_msg(work->response_buf);
640+
rsp_hdr = smb_get_msg(work->response_buf);
641641
memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
642642
rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
643643
rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
@@ -651,7 +651,7 @@ static void __smb2_oplock_break_noti(struct work_struct *wk)
651651
rsp_hdr->SessionId = 0;
652652
memset(rsp_hdr->Signature, 0, 16);
653653

654-
rsp = smb2_get_msg(work->response_buf);
654+
rsp = smb_get_msg(work->response_buf);
655655

656656
rsp->StructureSize = cpu_to_le16(24);
657657
if (!br_info->open_trunc &&
@@ -744,7 +744,7 @@ static void __smb2_lease_break_noti(struct work_struct *wk)
744744
goto out;
745745
}
746746

747-
rsp_hdr = smb2_get_msg(work->response_buf);
747+
rsp_hdr = smb_get_msg(work->response_buf);
748748
memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
749749
rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
750750
rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
@@ -758,7 +758,7 @@ static void __smb2_lease_break_noti(struct work_struct *wk)
758758
rsp_hdr->SessionId = 0;
759759
memset(rsp_hdr->Signature, 0, 16);
760760

761-
rsp = smb2_get_msg(work->response_buf);
761+
rsp = smb_get_msg(work->response_buf);
762762
rsp->StructureSize = cpu_to_le16(44);
763763
rsp->Epoch = br_info->epoch;
764764
rsp->Flags = 0;

‎fs/smb/server/server.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ static inline int check_conn_state(struct ksmbd_work *work)
9595

9696
if (ksmbd_conn_exiting(work->conn) ||
9797
ksmbd_conn_need_reconnect(work->conn)) {
98-
rsp_hdr = work->response_buf;
98+
rsp_hdr = smb_get_msg(work->response_buf);
9999
rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED;
100100
return 1;
101101
}

‎fs/smb/server/smb2pdu.c‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ static void __wbuf(struct ksmbd_work *work, void **req, void **rsp)
4747
*req = ksmbd_req_buf_next(work);
4848
*rsp = ksmbd_resp_buf_next(work);
4949
} else {
50-
*req = smb2_get_msg(work->request_buf);
51-
*rsp = smb2_get_msg(work->response_buf);
50+
*req = smb_get_msg(work->request_buf);
51+
*rsp = smb_get_msg(work->response_buf);
5252
}
5353
}
5454

@@ -146,7 +146,7 @@ void smb2_set_err_rsp(struct ksmbd_work *work)
146146
if (work->next_smb2_rcv_hdr_off)
147147
err_rsp = ksmbd_resp_buf_next(work);
148148
else
149-
err_rsp = smb2_get_msg(work->response_buf);
149+
err_rsp = smb_get_msg(work->response_buf);
150150

151151
if (err_rsp->hdr.Status != STATUS_STOPPED_ON_SYMLINK) {
152152
int err;
@@ -172,7 +172,7 @@ void smb2_set_err_rsp(struct ksmbd_work *work)
172172
*/
173173
bool is_smb2_neg_cmd(struct ksmbd_work *work)
174174
{
175-
struct smb2_hdr *hdr = smb2_get_msg(work->request_buf);
175+
struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
176176

177177
/* is it SMB2 header ? */
178178
if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
@@ -196,7 +196,7 @@ bool is_smb2_neg_cmd(struct ksmbd_work *work)
196196
*/
197197
bool is_smb2_rsp(struct ksmbd_work *work)
198198
{
199-
struct smb2_hdr *hdr = smb2_get_msg(work->response_buf);
199+
struct smb2_hdr *hdr = smb_get_msg(work->response_buf);
200200

201201
/* is it SMB2 header ? */
202202
if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
@@ -222,7 +222,7 @@ u16 get_smb2_cmd_val(struct ksmbd_work *work)
222222
if (work->next_smb2_rcv_hdr_off)
223223
rcv_hdr = ksmbd_req_buf_next(work);
224224
else
225-
rcv_hdr = smb2_get_msg(work->request_buf);
225+
rcv_hdr = smb_get_msg(work->request_buf);
226226
return le16_to_cpu(rcv_hdr->Command);
227227
}
228228

@@ -235,7 +235,7 @@ void set_smb2_rsp_status(struct ksmbd_work *work, __le32 err)
235235
{
236236
struct smb2_hdr *rsp_hdr;
237237

238-
rsp_hdr = smb2_get_msg(work->response_buf);
238+
rsp_hdr = smb_get_msg(work->response_buf);
239239
rsp_hdr->Status = err;
240240

241241
work->iov_idx = 0;
@@ -258,7 +258,7 @@ int init_smb2_neg_rsp(struct ksmbd_work *work)
258258
struct ksmbd_conn *conn = work->conn;
259259
int err;
260260

261-
rsp_hdr = smb2_get_msg(work->response_buf);
261+
rsp_hdr = smb_get_msg(work->response_buf);
262262
memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
263263
rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
264264
rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
@@ -272,7 +272,7 @@ int init_smb2_neg_rsp(struct ksmbd_work *work)
272272
rsp_hdr->SessionId = 0;
273273
memset(rsp_hdr->Signature, 0, 16);
274274

275-
rsp = smb2_get_msg(work->response_buf);
275+
rsp = smb_get_msg(work->response_buf);
276276

277277
WARN_ON(ksmbd_conn_good(conn));
278278

@@ -446,7 +446,7 @@ static void init_chained_smb2_rsp(struct ksmbd_work *work)
446446
*/
447447
bool is_chained_smb2_message(struct ksmbd_work *work)
448448
{
449-
struct smb2_hdr *hdr = smb2_get_msg(work->request_buf);
449+
struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
450450
unsigned int len, next_cmd;
451451

452452
if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
@@ -497,8 +497,8 @@ bool is_chained_smb2_message(struct ksmbd_work *work)
497497
*/
498498
int init_smb2_rsp_hdr(struct ksmbd_work *work)
499499
{
500-
struct smb2_hdr *rsp_hdr = smb2_get_msg(work->response_buf);
501-
struct smb2_hdr *rcv_hdr = smb2_get_msg(work->request_buf);
500+
struct smb2_hdr *rsp_hdr = smb_get_msg(work->response_buf);
501+
struct smb2_hdr *rcv_hdr = smb_get_msg(work->request_buf);
502502

503503
memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
504504
rsp_hdr->ProtocolId = rcv_hdr->ProtocolId;
@@ -527,7 +527,7 @@ int init_smb2_rsp_hdr(struct ksmbd_work *work)
527527
*/
528528
int smb2_allocate_rsp_buf(struct ksmbd_work *work)
529529
{
530-
struct smb2_hdr *hdr = smb2_get_msg(work->request_buf);
530+
struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
531531
size_t small_sz = MAX_CIFS_SMALL_BUFFER_SIZE;
532532
size_t large_sz = small_sz + work->conn->vals->max_trans_size;
533533
size_t sz = small_sz;
@@ -543,7 +543,7 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work)
543543
offsetof(struct smb2_query_info_req, OutputBufferLength))
544544
return -EINVAL;
545545

546-
req = smb2_get_msg(work->request_buf);
546+
req = smb_get_msg(work->request_buf);
547547
if ((req->InfoType == SMB2_O_INFO_FILE &&
548548
(req->FileInfoClass == FILE_FULL_EA_INFORMATION ||
549549
req->FileInfoClass == FILE_ALL_INFORMATION)) ||
@@ -712,10 +712,10 @@ void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status)
712712
}
713713

714714
in_work->conn = work->conn;
715-
memcpy(smb2_get_msg(in_work->response_buf), ksmbd_resp_buf_next(work),
715+
memcpy(smb_get_msg(in_work->response_buf), ksmbd_resp_buf_next(work),
716716
__SMB2_HEADER_STRUCTURE_SIZE);
717717

718-
rsp_hdr = smb2_get_msg(in_work->response_buf);
718+
rsp_hdr = smb_get_msg(in_work->response_buf);
719719
rsp_hdr->Flags |= SMB2_FLAGS_ASYNC_COMMAND;
720720
rsp_hdr->Id.AsyncId = cpu_to_le64(work->async_id);
721721
smb2_set_err_rsp(in_work);
@@ -1093,8 +1093,8 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn,
10931093
int smb2_handle_negotiate(struct ksmbd_work *work)
10941094
{
10951095
struct ksmbd_conn *conn = work->conn;
1096-
struct smb2_negotiate_req *req = smb2_get_msg(work->request_buf);
1097-
struct smb2_negotiate_rsp *rsp = smb2_get_msg(work->response_buf);
1096+
struct smb2_negotiate_req *req = smb_get_msg(work->request_buf);
1097+
struct smb2_negotiate_rsp *rsp = smb_get_msg(work->response_buf);
10981098
int rc = 0;
10991099
unsigned int smb2_buf_len, smb2_neg_size, neg_ctxt_len = 0;
11001100
__le32 status;
@@ -5967,7 +5967,7 @@ int smb2_close(struct ksmbd_work *work)
59675967
*/
59685968
int smb2_echo(struct ksmbd_work *work)
59695969
{
5970-
struct smb2_echo_rsp *rsp = smb2_get_msg(work->response_buf);
5970+
struct smb2_echo_rsp *rsp = smb_get_msg(work->response_buf);
59715971

59725972
ksmbd_debug(SMB, "Received smb2 echo request\n");
59735973

@@ -6520,8 +6520,8 @@ int smb2_set_info(struct ksmbd_work *work)
65206520
pid = work->compound_pfid;
65216521
}
65226522
} else {
6523-
req = smb2_get_msg(work->request_buf);
6524-
rsp = smb2_get_msg(work->response_buf);
6523+
req = smb_get_msg(work->request_buf);
6524+
rsp = smb_get_msg(work->response_buf);
65256525
}
65266526

65276527
if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
@@ -6754,8 +6754,8 @@ int smb2_read(struct ksmbd_work *work)
67546754
pid = work->compound_pfid;
67556755
}
67566756
} else {
6757-
req = smb2_get_msg(work->request_buf);
6758-
rsp = smb2_get_msg(work->response_buf);
6757+
req = smb_get_msg(work->request_buf);
6758+
rsp = smb_get_msg(work->response_buf);
67596759
}
67606760

67616761
if (!has_file_id(id)) {
@@ -7183,7 +7183,7 @@ int smb2_flush(struct ksmbd_work *work)
71837183
int smb2_cancel(struct ksmbd_work *work)
71847184
{
71857185
struct ksmbd_conn *conn = work->conn;
7186-
struct smb2_hdr *hdr = smb2_get_msg(work->request_buf);
7186+
struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
71877187
struct smb2_hdr *chdr;
71887188
struct ksmbd_work *iter;
71897189
struct list_head *command_list;
@@ -7200,7 +7200,7 @@ int smb2_cancel(struct ksmbd_work *work)
72007200
spin_lock(&conn->request_lock);
72017201
list_for_each_entry(iter, command_list,
72027202
async_request_entry) {
7203-
chdr = smb2_get_msg(iter->request_buf);
7203+
chdr = smb_get_msg(iter->request_buf);
72047204

72057205
if (iter->async_id !=
72067206
le64_to_cpu(hdr->Id.AsyncId))
@@ -7221,7 +7221,7 @@ int smb2_cancel(struct ksmbd_work *work)
72217221

72227222
spin_lock(&conn->request_lock);
72237223
list_for_each_entry(iter, command_list, request_entry) {
7224-
chdr = smb2_get_msg(iter->request_buf);
7224+
chdr = smb_get_msg(iter->request_buf);
72257225

72267226
if (chdr->MessageId != hdr->MessageId ||
72277227
iter == work)
@@ -8151,8 +8151,8 @@ int smb2_ioctl(struct ksmbd_work *work)
81518151
id = work->compound_fid;
81528152
}
81538153
} else {
8154-
req = smb2_get_msg(work->request_buf);
8155-
rsp = smb2_get_msg(work->response_buf);
8154+
req = smb_get_msg(work->request_buf);
8155+
rsp = smb_get_msg(work->response_buf);
81568156
}
81578157

81588158
if (!has_file_id(id))
@@ -8817,7 +8817,7 @@ int smb2_notify(struct ksmbd_work *work)
88178817
*/
88188818
bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command)
88198819
{
8820-
struct smb2_hdr *rcv_hdr2 = smb2_get_msg(work->request_buf);
8820+
struct smb2_hdr *rcv_hdr2 = smb_get_msg(work->request_buf);
88218821

88228822
if ((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) &&
88238823
command != SMB2_NEGOTIATE_HE &&
@@ -8842,7 +8842,7 @@ int smb2_check_sign_req(struct ksmbd_work *work)
88428842
struct kvec iov[1];
88438843
size_t len;
88448844

8845-
hdr = smb2_get_msg(work->request_buf);
8845+
hdr = smb_get_msg(work->request_buf);
88468846
if (work->next_smb2_rcv_hdr_off)
88478847
hdr = ksmbd_req_buf_next(work);
88488848

@@ -8916,7 +8916,7 @@ int smb3_check_sign_req(struct ksmbd_work *work)
89168916
struct kvec iov[1];
89178917
size_t len;
89188918

8919-
hdr = smb2_get_msg(work->request_buf);
8919+
hdr = smb_get_msg(work->request_buf);
89208920
if (work->next_smb2_rcv_hdr_off)
89218921
hdr = ksmbd_req_buf_next(work);
89228922

@@ -9049,7 +9049,7 @@ void smb3_preauth_hash_rsp(struct ksmbd_work *work)
90499049
static void fill_transform_hdr(void *tr_buf, char *old_buf, __le16 cipher_type)
90509050
{
90519051
struct smb2_transform_hdr *tr_hdr = tr_buf + 4;
9052-
struct smb2_hdr *hdr = smb2_get_msg(old_buf);
9052+
struct smb2_hdr *hdr = smb_get_msg(old_buf);
90539053
unsigned int orig_len = get_rfc1002_len(old_buf);
90549054

90559055
/* tr_buf must be cleared by the caller */
@@ -9088,7 +9088,7 @@ int smb3_encrypt_resp(struct ksmbd_work *work)
90889088

90899089
bool smb3_is_transform_hdr(void *buf)
90909090
{
9091-
struct smb2_transform_hdr *trhdr = smb2_get_msg(buf);
9091+
struct smb2_transform_hdr *trhdr = smb_get_msg(buf);
90929092

90939093
return trhdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM;
90949094
}
@@ -9100,7 +9100,7 @@ int smb3_decrypt_req(struct ksmbd_work *work)
91009100
unsigned int pdu_length = get_rfc1002_len(buf);
91019101
struct kvec iov[2];
91029102
int buf_data_size = pdu_length - sizeof(struct smb2_transform_hdr);
9103-
struct smb2_transform_hdr *tr_hdr = smb2_get_msg(buf);
9103+
struct smb2_transform_hdr *tr_hdr = smb_get_msg(buf);
91049104
int rc = 0;
91059105

91069106
if (pdu_length < sizeof(struct smb2_transform_hdr) ||
@@ -9141,7 +9141,7 @@ bool smb3_11_final_sess_setup_resp(struct ksmbd_work *work)
91419141
{
91429142
struct ksmbd_conn *conn = work->conn;
91439143
struct ksmbd_session *sess = work->sess;
9144-
struct smb2_hdr *rsp = smb2_get_msg(work->response_buf);
9144+
struct smb2_hdr *rsp = smb_get_msg(work->response_buf);
91459145

91469146
if (conn->dialect < SMB30_PROT_ID)
91479147
return false;

‎fs/smb/server/smb2pdu.h‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -383,15 +383,6 @@ int smb2_ioctl(struct ksmbd_work *work);
383383
int smb2_oplock_break(struct ksmbd_work *work);
384384
int smb2_notify(struct ksmbd_work *ksmbd_work);
385385

386-
/*
387-
* Get the body of the smb2 message excluding the 4 byte rfc1002 headers
388-
* from request/response buffer.
389-
*/
390-
static inline void *smb2_get_msg(void *buf)
391-
{
392-
return buf + 4;
393-
}
394-
395386
#define POSIX_TYPE_FILE 0
396387
#define POSIX_TYPE_DIR 1
397388
#define POSIX_TYPE_SYMLINK 2

0 commit comments

Comments
 (0)