github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ksmbd: return buffer too small for short security queries

Browse Source 
SMB2 QUERY_INFO security requests with an output buffer too small for
the self-relative security descriptor header can fall through descriptor
construction and be reported as STATUS_INVALID_INFO_CLASS.

After validating the file handle, reject buffers shorter than struct
smb_ntsd with STATUS_BUFFER_TOO_SMALL before building the descriptor.

This fixes smb2.getinfo.qsec_buffercheck.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Namjae Jeon 2026-07-07 00:19:39 +09:00
parent 6b8b79226b
commit 2103add92a
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/smb/server/smb2pdu.c
View File

@ -6348,6 +6348,12 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
if (!fp)
return -ENOENT;
if (le32_to_cpu(req->OutputBufferLength) < sizeof(struct smb_ntsd)) {
rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL;
ksmbd_fd_put(work, fp);
return -ENOSPC;
}
idmap = file_mnt_idmap(fp->filp);
inode = file_inode(fp->filp);
ksmbd_acls_fattr(&fattr, idmap, inode);