diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2026-07-04 12:23:14 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2026-07-22 09:54:10 -0500 |
| commit | 5e1b924808568e89c5cb132ecebe1824bd91af0c (patch) | |
| tree | cb3a0e910552b07035359ea3621da27eb9935018 | |
| parent | cfc0b8e5080aec87700774e8568765eaa4b7b92b (diff) | |
| download | linux-5e1b924808568e89c5cb132ecebe1824bd91af0c.tar.gz linux-5e1b924808568e89c5cb132ecebe1824bd91af0c.tar.bz2 linux-5e1b924808568e89c5cb132ecebe1824bd91af0c.zip | |
ksmbd: reject undersized decompressed SMB2 requests
ksmbd_decompress_request() bounds the decompressed size only against
the maximum request size. A compression transform can therefore
produce a buffer smaller than an SMB2 PDU and install it as
conn->request_buf.
The receive path subsequently calls ksmbd_smb_request(), which reads
the protocol ID before the normal SMB2 minimum-size check. If the
decompressed output is too short, that read can access beyond the
request allocation.
Require the decompressed output to contain at least a complete minimum
SMB2 PDU before allocating and installing the replacement request
buffer.
Fixes: a08de24c2b85 ("ksmbd: negotiate and decode SMB2 compression")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/server/compress.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/smb/server/compress.c b/fs/smb/server/compress.c index f8cf515b9c30..95e48fa6b448 100644 --- a/fs/smb/server/compress.c +++ b/fs/smb/server/compress.c @@ -56,7 +56,8 @@ int ksmbd_decompress_request(struct ksmbd_conn *conn) } max_allowed_pdu_size = SMB3_MAX_MSGSIZE + conn->vals->max_write_size; - if (out_size > max_allowed_pdu_size || + if (out_size < sizeof(struct smb2_pdu) || + out_size > max_allowed_pdu_size || out_size > MAX_STREAM_PROT_LEN) return -EINVAL; |