ksmbd: fix transform header validation

Validate that the transform and smb request headers are present
before checking OriginalMessageSize and SessionId fields.

Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Ralph Böhme <slow@samba.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Tom Talpey <tom@talpey.com>
Acked-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 99c6349a44fa6a30ef2c3c50717a4d1e2d98f5c9..dcf9077386108d1044fa1b397243f0df1c02d4ac 100644 (file)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -8414,16 +8414,8 @@ int smb3_decrypt_req(struct ksmbd_work *work)
        unsigned int buf_data_size = pdu_length + 4 -
                sizeof(struct smb2_transform_hdr);
        struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)buf;
-       unsigned int orig_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
        int rc = 0;
 
-       sess = ksmbd_session_lookup_all(conn, le64_to_cpu(tr_hdr->SessionId));
-       if (!sess) {
-               pr_err("invalid session id(%llx) in transform header\n",
-                      le64_to_cpu(tr_hdr->SessionId));
-               return -ECONNABORTED;
-       }
-
        if (pdu_length + 4 <
            sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr)) {
                pr_err("Transform message is too small (%u)\n",
@@ -8431,11 +8423,19 @@ int smb3_decrypt_req(struct ksmbd_work *work)
                return -ECONNABORTED;
        }
 
-       if (pdu_length + 4 < orig_len + sizeof(struct smb2_transform_hdr)) {
+       if (pdu_length + 4 <
+           le32_to_cpu(tr_hdr->OriginalMessageSize) + sizeof(struct smb2_transform_hdr)) {
                pr_err("Transform message is broken\n");
                return -ECONNABORTED;
        }
 
+       sess = ksmbd_session_lookup_all(conn, le64_to_cpu(tr_hdr->SessionId));
+       if (!sess) {
+               pr_err("invalid session id(%llx) in transform header\n",
+                      le64_to_cpu(tr_hdr->SessionId));
+               return -ECONNABORTED;
+       }
+
        iov[0].iov_base = buf;
        iov[0].iov_len = sizeof(struct smb2_transform_hdr);
        iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr);