Re: [PATCH v3] ksmbd: validate length in smb2_write()

[Marios Makassikis <mmakassikis@freebox.fr>]

On Fri, May 6, 2022 at 1:42 AM Hyunchul Lee <hyc.lee@gmail.com> wrote:
>
> Hello Marios,
>
> 2022년 5월 5일 (목) 오후 4:00, Marios Makassikis <mmakassikis@freebox.fr>님이 작성:
>
> >
> > The SMB2 Write packet contains data that is to be written
> > to a file or to a pipe. Depending on the client, there may
> > be padding between the header and the data field.
> > Currently, the length is validated only in the case padding
> > is present.
> >
> > Since the DataOffset field always points to the beginning
> > of the data, there is no need to have a special case for
> > padding. By removing this, the length is validated in both
> > cases.
> >
> > Additionally, fix the length check: DataOffset and Length
> > fields are relative to the SMB header start, while the packet
> > length returned by get_rfc1002_len() includes 4 additional
> > bytes.
> >
>
> get_rfc1002_len doesn't include additional 4 bytes.
> Can you check it again?
>

Hello Hyunchul, Namjae,

You are both right, v3 is not necessary. My confusion came from
looking at earlier code (without the changes to smb2_hdr) rather
than the latest tree.

Thanks for checking it.

Marios