ksmbd: check protocol id in ksmbd_verify_smb_message()

When second smb2 pdu has invalid protocol id, ksmbd doesn't detect it
and allow to process smb2 request. This patch add the check it in
ksmbd_verify_smb_message() and don't use protocol id of smb2 request as
protocol id of response.

Reviewed-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Reviewed-by: Ralph Böhme <slow@samba.org>
Reported-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index f59f9b8be51c08432b5bc754a416b308c089c223..fd9d5595a5cadc75e53680b0787cb6d2f0ab69d0 100644 (file)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -433,7 +433,7 @@ static void init_chained_smb2_rsp(struct ksmbd_work *work)
                work->compound_pfid = KSMBD_NO_FID;
        }
        memset((char *)rsp_hdr + 4, 0, sizeof(struct smb2_hdr) + 2);
-       rsp_hdr->ProtocolId = rcv_hdr->ProtocolId;
+       rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
        rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
        rsp_hdr->Command = rcv_hdr->Command;
 

diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c
index 43d3123d8b62ed8731b1b7e4ad3b07ce8e9eb2d5..40f4fafa2e112ae2ad7911221975ef495281e3ac 100644 (file)
--- a/fs/ksmbd/smb_common.c
+++ b/fs/ksmbd/smb_common.c
@@ -129,16 +129,22 @@ int ksmbd_lookup_protocol_idx(char *str)
  *
  * check for valid smb signature and packet direction(request/response)
  *
- * Return:      0 on success, otherwise 1
+ * Return:      0 on success, otherwise -EINVAL
  */
 int ksmbd_verify_smb_message(struct ksmbd_work *work)
 {
-       struct smb2_hdr *smb2_hdr = work->request_buf;
+       struct smb2_hdr *smb2_hdr = work->request_buf + work->next_smb2_rcv_hdr_off;
+       struct smb_hdr *hdr;
 
        if (smb2_hdr->ProtocolId == SMB2_PROTO_NUMBER)
                return ksmbd_smb2_check_message(work);
 
-       return 0;
+       hdr = work->request_buf;
+       if (*(__le32 *)hdr->Protocol == SMB1_PROTO_NUMBER &&
+           hdr->Command == SMB_COM_NEGOTIATE)
+               return 0;
+
+       return -EINVAL;
 }
 
 /**
@@ -265,7 +271,6 @@ static int ksmbd_negotiate_smb_dialect(void *buf)
        return BAD_PROT_ID;
 }
 
-#define SMB_COM_NEGOTIATE      0x72
 int ksmbd_init_smb_server(struct ksmbd_work *work)
 {
        struct ksmbd_conn *conn = work->conn;

diff --git a/fs/ksmbd/smb_common.h b/fs/ksmbd/smb_common.h
index 57c667c1be0694289fc2f314d568ec396b77a4f8..0a6af447cc4515711fad2abd476479d586ba15d6 100644 (file)
--- a/fs/ksmbd/smb_common.h
+++ b/fs/ksmbd/smb_common.h
@@ -210,6 +210,7 @@
                FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES)
 
 #define SMB1_PROTO_NUMBER              cpu_to_le32(0x424d53ff)
+#define SMB_COM_NEGOTIATE              0x72
 
 #define SMB1_CLIENT_GUID_SIZE          (16)
 struct smb_hdr {