All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ralph Boehme <slow@samba.org>
To: linux-cifs@vger.kernel.org
Cc: Ralph Boehme <slow@samba.org>,
	Namjae Jeon <linkinjeon@kernel.org>, Tom Talpey <tom@talpey.com>,
	Ronnie Sahlberg <ronniesahlberg@gmail.com>,
	Steve French <smfrench@gmail.com>,
	Hyunchul Lee <hyc.lee@gmail.com>
Subject: [PATCH v6 12/14] ksmbd: make smb2_check_user_session() callable for compound PDUs
Date: Sat,  2 Oct 2021 15:12:10 +0200	[thread overview]
Message-ID: <20211002131212.130629-13-slow@samba.org> (raw)
In-Reply-To: <20211002131212.130629-1-slow@samba.org>

Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Steve French <smfrench@gmail.com>
Cc: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Ralph Boehme <slow@samba.org>
---
 fs/ksmbd/smb2pdu.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 8cbce9a9c2e0..2f71905503b5 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -416,7 +416,6 @@ static void init_chained_smb2_rsp(struct ksmbd_work *work)
 		work->compound_pfid =
 			le64_to_cpu(((struct smb2_create_rsp *)rsp)->
 				PersistentFileId);
-		work->compound_sid = le64_to_cpu(rsp->SessionId);
 	}
 
 	len = get_rfc1002_len(work->response_buf) - work->next_smb2_rsp_hdr_off;
@@ -596,7 +595,6 @@ int smb2_check_user_session(struct ksmbd_work *work)
 	unsigned int cmd = conn->ops->get_cmd_val(work);
 	unsigned long long sess_id;
 
-	work->sess = NULL;
 	/*
 	 * SMB2_ECHO, SMB2_NEGOTIATE, SMB2_SESSION_SETUP command do not
 	 * require a session id, so no need to validate user session's for
@@ -609,11 +607,25 @@ int smb2_check_user_session(struct ksmbd_work *work)
 	if (!ksmbd_conn_good(work))
 		return -EINVAL;
 
+	if (req_hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS) {
+		if (work->sess) {
+			pr_err("Missing session\n");
+			return -EINVAL;
+		}
+		return 1;
+	}
+
+	work->sess = NULL;
+	work->compound_sid = 0;
+
 	sess_id = le64_to_cpu(req_hdr->SessionId);
+
 	/* Check for validity of user session */
 	work->sess = ksmbd_session_lookup_all(conn, sess_id);
-	if (work->sess)
+	if (work->sess) {
+		work->compound_sid = sess_id;
 		return 1;
+	}
 	ksmbd_debug(SMB, "Invalid user session, Uid %llu\n", sess_id);
 	return -EINVAL;
 }
-- 
2.31.1


  parent reply	other threads:[~2021-10-02 13:25 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-02 13:11 [PATCH v6 00/14] Buffer validation patches Ralph Boehme
2021-10-02 13:11 ` [PATCH v6 01/14] ksmbd: add the check to vaildate if stream protocol length exceeds maximum value Ralph Boehme
2021-10-03  1:18   ` Namjae Jeon
2021-10-05  4:24     ` Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 02/14] ksmbd: add validation in smb2_ioctl Ralph Boehme
2021-10-03  1:21   ` Namjae Jeon
2021-10-02 13:12 ` [PATCH v6 03/14] ksmbd: check strictly data area in ksmbd_smb2_check_message() Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 04/14] ksmbd: remove the leftover of smb2.0 dialect support Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 05/14] ksmbd: use ksmbd_req_buf_next() in ksmbd_verify_smb_message() Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 06/14] ksmbd: check buffer is big enough to access the ProtocolId field Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 07/14] ksmbd: use ksmbd_req_buf_next() in ksmbd_smb2_check_message() Ralph Boehme
2021-10-03  0:59   ` Namjae Jeon
2021-10-05  4:28     ` Ralph Boehme
2021-10-05 18:43       ` Steve French
2021-10-05 19:28         ` Ralph Boehme
2021-10-05 20:20           ` Steve French
2021-10-02 13:12 ` [PATCH v6 08/14] ksmbd: use ksmbd_smb2_cur_pdu_buflen() " Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 09/14] ksmbd: check PDU len is at least header plus body size " Ralph Boehme
2021-10-03  1:11   ` Namjae Jeon
2021-10-05  4:32     ` Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 10/14] ksmdb: use cmd helper variable in smb2_get_ksmbd_tcon() Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 11/14] ksmdb: make smb2_get_ksmbd_tcon() callable with chained PDUs Ralph Boehme
2021-10-02 13:12 ` Ralph Boehme [this message]
2021-10-02 13:12 ` [PATCH v6 13/14] ksmdb: move session and tcon validation to ksmbd_smb2_check_message() Ralph Boehme
2021-10-02 13:12 ` [PATCH v6 14/14] ksmdb: validate credit charge after validating SMB2 PDU body size Ralph Boehme

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211002131212.130629-13-slow@samba.org \
    --to=slow@samba.org \
    --cc=hyc.lee@gmail.com \
    --cc=linkinjeon@kernel.org \
    --cc=linux-cifs@vger.kernel.org \
    --cc=ronniesahlberg@gmail.com \
    --cc=smfrench@gmail.com \
    --cc=tom@talpey.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.