Skip to content

Commit c7705ee

Browse files
namjaejeonSteve French
authored andcommitted
ksmbd: use buf_data_size instead of recalculation in smb3_decrypt_req()
Tom suggested to use buf_data_size that is already calculated, to verify these offsets. Cc: Tom Talpey <[email protected]> Cc: Ronnie Sahlberg <[email protected]> Cc: Ralph Böhme <[email protected]> Suggested-by: Tom Talpey <[email protected]> Acked-by: Hyunchul Lee <[email protected]> Signed-off-by: Namjae Jeon <[email protected]> Signed-off-by: Steve French <[email protected]>
1 parent 51a1387 commit c7705ee

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

fs/ksmbd/smb2pdu.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8395,20 +8395,18 @@ int smb3_decrypt_req(struct ksmbd_work *work)
83958395
struct smb2_hdr *hdr;
83968396
unsigned int pdu_length = get_rfc1002_len(buf);
83978397
struct kvec iov[2];
8398-
unsigned int buf_data_size = pdu_length + 4 -
8398+
int buf_data_size = pdu_length + 4 -
83998399
sizeof(struct smb2_transform_hdr);
84008400
struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)buf;
84018401
int rc = 0;
84028402

8403-
if (pdu_length + 4 <
8404-
sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr)) {
8403+
if (buf_data_size < sizeof(struct smb2_hdr)) {
84058404
pr_err("Transform message is too small (%u)\n",
84068405
pdu_length);
84078406
return -ECONNABORTED;
84088407
}
84098408

8410-
if (pdu_length + 4 <
8411-
le32_to_cpu(tr_hdr->OriginalMessageSize) + sizeof(struct smb2_transform_hdr)) {
8409+
if (buf_data_size < le32_to_cpu(tr_hdr->OriginalMessageSize)) {
84128410
pr_err("Transform message is broken\n");
84138411
return -ECONNABORTED;
84148412
}

0 commit comments

Comments
 (0)