Merge tag 'v7.2-rc4-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:
 "This contains eight ksmbd fixes covering POSIX ACL handling, SMB
  signing enforcement, DACL parsing and construction hardening, session
  lifetime handling, and validation of malformed transform and
  compressed SMB2 requests:

   - preserve inherited POSIX ACL mask when creating objects.

   - enforce the session signing requirement for plaintext SMB requests.

   - harden DACL/ACE processing against size overflows, incomplete ACE
     copies, and undersized SIDs.

   - defer teardown of a previous session until NTLM authentication
     succeeds.

   - reject undersized encryption-transform and decompressed SMB2
     requests before they can reach normal SMB2 request processing"

* tag 'v7.2-rc4-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: reject undersized decompressed SMB2 requests
  ksmbd: validate minimum PDU size for transform requests
  ksmbd: defer destroy_previous_session() until after NTLM authentication
  ksmbd: validate ACE size against SID sub-authorities
  ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
  ksmbd: bound DACL dedup walk to copied ACEs
  ksmbd: enforce signing required by the session
  ksmbd: preserve VFS inherited POSIX ACL mask

1 files changed, 2 insertions, 1 deletions

diff --git a/fs/smb/server/compress.c b/fs/smb/server/compress.c
index f8cf515b9c30..95e48fa6b448 100644
--- a/fs/smb/server/compress.c
+++ b/fs/smb/server/compress.c
@@ -56,7 +56,8 @@ int ksmbd_decompress_request(struct ksmbd_conn *conn)
 	}
 
 	max_allowed_pdu_size = SMB3_MAX_MSGSIZE + conn->vals->max_write_size;
-	if (out_size > max_allowed_pdu_size ||
+	if (out_size < sizeof(struct smb2_pdu) ||
+	    out_size > max_allowed_pdu_size ||
 	    out_size > MAX_STREAM_PROT_LEN)
 		return -EINVAL;