* [PATCH v2] ksmbd: add buffer validation for smb direct
@ 2021-10-14 21:02 Hyunchul Lee
2021-10-15 0:49 ` Namjae Jeon
0 siblings, 1 reply; 2+ messages in thread
From: Hyunchul Lee @ 2021-10-14 21:02 UTC (permalink / raw)
To: linux-cifs
Cc: Namjae Jeon, Sergey Senozhatsky, Steve French, Ralph Boehme,
Hyunchul Lee
Add buffer validation for smb direct.
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
---
Changes from v1:
- Change the data type of data_length to unsigned int.
- To avoid integer overflow, convert the data type of data_length
to u64 in comparision.
- Remove duplicate le32_to_cpu() calls.
fs/ksmbd/transport_rdma.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/fs/ksmbd/transport_rdma.c b/fs/ksmbd/transport_rdma.c
index 3a7fa23ba850..a2fd5a4d4cd5 100644
--- a/fs/ksmbd/transport_rdma.c
+++ b/fs/ksmbd/transport_rdma.c
@@ -549,6 +549,10 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
switch (recvmsg->type) {
case SMB_DIRECT_MSG_NEGOTIATE_REQ:
+ if (wc->byte_len < sizeof(struct smb_direct_negotiate_req)) {
+ put_empty_recvmsg(t, recvmsg);
+ return;
+ }
t->negotiation_requested = true;
t->full_packet_received = true;
wake_up_interruptible(&t->wait_status);
@@ -556,10 +560,23 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
case SMB_DIRECT_MSG_DATA_TRANSFER: {
struct smb_direct_data_transfer *data_transfer =
(struct smb_direct_data_transfer *)recvmsg->packet;
- int data_length = le32_to_cpu(data_transfer->data_length);
+ unsigned int data_length;
int avail_recvmsg_count, receive_credits;
+ if (wc->byte_len <
+ offsetof(struct smb_direct_data_transfer, padding)) {
+ put_empty_recvmsg(t, recvmsg);
+ return;
+ }
+
+ data_length = le32_to_cpu(data_transfer->data_length);
if (data_length) {
+ if (wc->byte_len < sizeof(struct smb_direct_data_transfer) +
+ (u64)data_length) {
+ put_empty_recvmsg(t, recvmsg);
+ return;
+ }
+
if (t->full_packet_received)
recvmsg->first_segment = true;
@@ -568,7 +585,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
else
t->full_packet_received = true;
- enqueue_reassembly(t, recvmsg, data_length);
+ enqueue_reassembly(t, recvmsg, (int)data_length);
wake_up_interruptible(&t->wait_reassembly_queue);
spin_lock(&t->receive_credit_lock);
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] ksmbd: add buffer validation for smb direct
2021-10-14 21:02 [PATCH v2] ksmbd: add buffer validation for smb direct Hyunchul Lee
@ 2021-10-15 0:49 ` Namjae Jeon
0 siblings, 0 replies; 2+ messages in thread
From: Namjae Jeon @ 2021-10-15 0:49 UTC (permalink / raw)
To: Hyunchul Lee; +Cc: linux-cifs, Sergey Senozhatsky, Steve French, Ralph Boehme
2021-10-15 6:02 GMT+09:00, Hyunchul Lee <hyc.lee@gmail.com>:
> Add buffer validation for smb direct.
>
> Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-10-15 0:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-14 21:02 [PATCH v2] ksmbd: add buffer validation for smb direct Hyunchul Lee
2021-10-15 0:49 ` Namjae Jeon
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.