ksmbd: fix out of bounds in init_smb2_rsp_hdr()

Browse source

[ Upstream commit 536bb492d3 ]

If client send smb2 negotiate request and then send smb1 negotiate
request, init_smb2_rsp_hdr is called for smb1 negotiate request since
need_neg is set to false. This patch ignore smb1 packets after ->need_neg
is set to false.

Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21541
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Namjae Jeon 2023-07-23 15:27:37 +09:00 • committed by Greg Kroah-Hartman

parent 99a2426b13

commit 330d900620

3 changed files with 18 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

fs/smb/server/server.c

View file

19

fs/smb/server/smb_common.c

View file

2

fs/smb/server/smb_common.h

View file