ksmbd: validate session id and tree id in compound request
authorNamjae Jeon <linkinjeon@kernel.org>
Sun, 23 Jul 2023 06:21:11 +0000 (15:21 +0900)
committerSteve French <stfrench@microsoft.com>
Sun, 23 Jul 2023 15:25:11 +0000 (10:25 -0500)
commit3df0411e132ee74a87aa13142dfd2b190275332e
treefddaba26c32ed7d1d83da6f94b12d27d8f8f55b8
parentdc318846f3dd54574a36ae97fc8d8b75dd7cdb1e
ksmbd: validate session id and tree id in compound request

`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()
will always return the first request smb2 header in a compound request.
if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will
return 0, i.e. The tree id check is skipped.
This patch use ksmbd_req_buf_next() to get current command in compound.

Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21506
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/smb2pdu.c