@@ -730,19 +730,14 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
730
730
731
731
int smb3_validate_negotiate (const unsigned int xid , struct cifs_tcon * tcon )
732
732
{
733
- int rc = 0 ;
734
- struct validate_negotiate_info_req vneg_inbuf ;
733
+ int rc ;
734
+ struct validate_negotiate_info_req * pneg_inbuf ;
735
735
struct validate_negotiate_info_rsp * pneg_rsp = NULL ;
736
736
u32 rsplen ;
737
737
u32 inbuflen ; /* max of 4 dialects */
738
738
739
739
cifs_dbg (FYI , "validate negotiate\n" );
740
740
741
- #ifdef CONFIG_CIFS_SMB_DIRECT
742
- if (tcon -> ses -> server -> rdma )
743
- return 0 ;
744
- #endif
745
-
746
741
/* In SMB3.11 preauth integrity supersedes validate negotiate */
747
742
if (tcon -> ses -> server -> dialect == SMB311_PROT_ID )
748
743
return 0 ;
@@ -765,63 +760,69 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
765
760
if (tcon -> ses -> session_flags & SMB2_SESSION_FLAG_IS_NULL )
766
761
cifs_dbg (VFS , "Unexpected null user (anonymous) auth flag sent by server\n" );
767
762
768
- vneg_inbuf .Capabilities =
763
+ pneg_inbuf = kmalloc (sizeof (* pneg_inbuf ), GFP_NOFS );
764
+ if (!pneg_inbuf )
765
+ return - ENOMEM ;
766
+
767
+ pneg_inbuf -> Capabilities =
769
768
cpu_to_le32 (tcon -> ses -> server -> vals -> req_capabilities );
770
- memcpy (vneg_inbuf . Guid , tcon -> ses -> server -> client_guid ,
769
+ memcpy (pneg_inbuf -> Guid , tcon -> ses -> server -> client_guid ,
771
770
SMB2_CLIENT_GUID_SIZE );
772
771
773
772
if (tcon -> ses -> sign )
774
- vneg_inbuf . SecurityMode =
773
+ pneg_inbuf -> SecurityMode =
775
774
cpu_to_le16 (SMB2_NEGOTIATE_SIGNING_REQUIRED );
776
775
else if (global_secflags & CIFSSEC_MAY_SIGN )
777
- vneg_inbuf . SecurityMode =
776
+ pneg_inbuf -> SecurityMode =
778
777
cpu_to_le16 (SMB2_NEGOTIATE_SIGNING_ENABLED );
779
778
else
780
- vneg_inbuf . SecurityMode = 0 ;
779
+ pneg_inbuf -> SecurityMode = 0 ;
781
780
782
781
783
782
if (strcmp (tcon -> ses -> server -> vals -> version_string ,
784
783
SMB3ANY_VERSION_STRING ) == 0 ) {
785
- vneg_inbuf . Dialects [0 ] = cpu_to_le16 (SMB30_PROT_ID );
786
- vneg_inbuf . Dialects [1 ] = cpu_to_le16 (SMB302_PROT_ID );
787
- vneg_inbuf . DialectCount = cpu_to_le16 (2 );
784
+ pneg_inbuf -> Dialects [0 ] = cpu_to_le16 (SMB30_PROT_ID );
785
+ pneg_inbuf -> Dialects [1 ] = cpu_to_le16 (SMB302_PROT_ID );
786
+ pneg_inbuf -> DialectCount = cpu_to_le16 (2 );
788
787
/* structure is big enough for 3 dialects, sending only 2 */
789
- inbuflen = sizeof (struct validate_negotiate_info_req ) - 2 ;
788
+ inbuflen = sizeof (* pneg_inbuf ) -
789
+ sizeof (pneg_inbuf -> Dialects [0 ]);
790
790
} else if (strcmp (tcon -> ses -> server -> vals -> version_string ,
791
791
SMBDEFAULT_VERSION_STRING ) == 0 ) {
792
- vneg_inbuf . Dialects [0 ] = cpu_to_le16 (SMB21_PROT_ID );
793
- vneg_inbuf . Dialects [1 ] = cpu_to_le16 (SMB30_PROT_ID );
794
- vneg_inbuf . Dialects [2 ] = cpu_to_le16 (SMB302_PROT_ID );
795
- vneg_inbuf . DialectCount = cpu_to_le16 (3 );
792
+ pneg_inbuf -> Dialects [0 ] = cpu_to_le16 (SMB21_PROT_ID );
793
+ pneg_inbuf -> Dialects [1 ] = cpu_to_le16 (SMB30_PROT_ID );
794
+ pneg_inbuf -> Dialects [2 ] = cpu_to_le16 (SMB302_PROT_ID );
795
+ pneg_inbuf -> DialectCount = cpu_to_le16 (3 );
796
796
/* structure is big enough for 3 dialects */
797
- inbuflen = sizeof (struct validate_negotiate_info_req );
797
+ inbuflen = sizeof (* pneg_inbuf );
798
798
} else {
799
799
/* otherwise specific dialect was requested */
800
- vneg_inbuf . Dialects [0 ] =
800
+ pneg_inbuf -> Dialects [0 ] =
801
801
cpu_to_le16 (tcon -> ses -> server -> vals -> protocol_id );
802
- vneg_inbuf . DialectCount = cpu_to_le16 (1 );
802
+ pneg_inbuf -> DialectCount = cpu_to_le16 (1 );
803
803
/* structure is big enough for 3 dialects, sending only 1 */
804
- inbuflen = sizeof (struct validate_negotiate_info_req ) - 4 ;
804
+ inbuflen = sizeof (* pneg_inbuf ) -
805
+ sizeof (pneg_inbuf -> Dialects [0 ]) * 2 ;
805
806
}
806
807
807
808
rc = SMB2_ioctl (xid , tcon , NO_FILE_ID , NO_FILE_ID ,
808
809
FSCTL_VALIDATE_NEGOTIATE_INFO , true /* is_fsctl */ ,
809
- (char * )& vneg_inbuf , sizeof (struct validate_negotiate_info_req ),
810
- (char * * )& pneg_rsp , & rsplen );
810
+ (char * )pneg_inbuf , inbuflen , (char * * )& pneg_rsp , & rsplen );
811
811
812
812
if (rc != 0 ) {
813
813
cifs_dbg (VFS , "validate protocol negotiate failed: %d\n" , rc );
814
- return - EIO ;
814
+ rc = - EIO ;
815
+ goto out_free_inbuf ;
815
816
}
816
817
817
- if (rsplen != sizeof (struct validate_negotiate_info_rsp )) {
818
+ rc = - EIO ;
819
+ if (rsplen != sizeof (* pneg_rsp )) {
818
820
cifs_dbg (VFS , "invalid protocol negotiate response size: %d\n" ,
819
821
rsplen );
820
822
821
823
/* relax check since Mac returns max bufsize allowed on ioctl */
822
- if ((rsplen > CIFSMaxBufSize )
823
- || (rsplen < sizeof (struct validate_negotiate_info_rsp )))
824
- goto err_rsp_free ;
824
+ if (rsplen > CIFSMaxBufSize || rsplen < sizeof (* pneg_rsp ))
825
+ goto out_free_rsp ;
825
826
}
826
827
827
828
/* check validate negotiate info response matches what we got earlier */
@@ -838,15 +839,17 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
838
839
goto vneg_out ;
839
840
840
841
/* validate negotiate successful */
842
+ rc = 0 ;
841
843
cifs_dbg (FYI , "validate negotiate info successful\n" );
842
- kfree (pneg_rsp );
843
- return 0 ;
844
+ goto out_free_rsp ;
844
845
845
846
vneg_out :
846
847
cifs_dbg (VFS , "protocol revalidation - security settings mismatch\n" );
847
- err_rsp_free :
848
+ out_free_rsp :
848
849
kfree (pneg_rsp );
849
- return - EIO ;
850
+ out_free_inbuf :
851
+ kfree (pneg_inbuf );
852
+ return rc ;
850
853
}
851
854
852
855
enum securityEnum
0 commit comments