ksmbd: fix out of bounds in init_smb2_rsp_hdr()
authorNamjae Jeon <linkinjeon@kernel.org>
Sun, 23 Jul 2023 06:27:37 +0000 (15:27 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 13 Sep 2023 07:42:21 +0000 (09:42 +0200)
commit330d900620dfc9893011d725b3620cd2ee0bc2bc
treeffff57f47f1ced9fb0350b4ef13611e61d89d344
parent99a2426b135e590ab7e2c930f7ce489ea1e4edbd
ksmbd: fix out of bounds in init_smb2_rsp_hdr()

[ Upstream commit 536bb492d39bb6c080c92f31e8a55fe9934f452b ]

If client send smb2 negotiate request and then send smb1 negotiate
request, init_smb2_rsp_hdr is called for smb1 negotiate request since
need_neg is set to false. This patch ignore smb1 packets after ->need_neg
is set to false.

Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21541
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/smb/server/server.c
fs/smb/server/smb_common.c
fs/smb/server/smb_common.h