ksmbd: remove unsafe_memcpy use in session setup

Kees pointed out to just use directly ->Buffer instead of pointing
->Buffer using offset not to use unsafe_memcpy().

Suggested-by: Kees Cook <kees@kernel.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 7121266daa02044e211447aa7afea983832afe73..72af3ab40b5c391db1dabf2f45e101cd979a0066 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1335,8 +1335,7 @@ static int ntlm_negotiate(struct ksmbd_work *work,
                return rc;
 
        sz = le16_to_cpu(rsp->SecurityBufferOffset);
-       chgblob =
-               (struct challenge_message *)((char *)&rsp->hdr.ProtocolId + sz);
+       chgblob = (struct challenge_message *)rsp->Buffer;
        memset(chgblob, 0, sizeof(struct challenge_message));
 
        if (!work->conn->use_spnego) {
@@ -1369,9 +1368,7 @@ static int ntlm_negotiate(struct ksmbd_work *work,
                goto out;
        }
 
-       sz = le16_to_cpu(rsp->SecurityBufferOffset);
-       unsafe_memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len,
-                       /* alloc is larger than blob, see smb2_allocate_rsp_buf() */);
+       memcpy(rsp->Buffer, spnego_blob, spnego_blob_len);
        rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
 
 out:
@@ -1453,10 +1450,7 @@ static int ntlm_authenticate(struct ksmbd_work *work,
                if (rc)
                        return -ENOMEM;
 
-               sz = le16_to_cpu(rsp->SecurityBufferOffset);
-               unsafe_memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob,
-                               spnego_blob_len,
-                               /* alloc is larger than blob, see smb2_allocate_rsp_buf() */);
+               memcpy(rsp->Buffer, spnego_blob, spnego_blob_len);
                rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
                kfree(spnego_blob);
        }