From dd562212178ef7bcd24e17efff172143fe2b705e Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Sun, 12 Jul 2026 14:31:02 +0900 Subject: [PATCH] ksmbd: validate object id handles before response buffers FSCTL_CREATE_OR_GET_OBJECT_ID requires a fixed-size output buffer, but an invalid file handle must take precedence over output buffer validation. Look up the handle before checking the available response buffer size. This returns STATUS_FILE_CLOSED for a closed handle while preserving the buffer size validation for valid handles. Signed-off-by: Namjae Jeon --- fs/smb/server/smb2pdu.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 685746c2b501..39ed43214aa5 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -9615,17 +9615,18 @@ int smb2_ioctl(struct ksmbd_work *work) struct file_object_buf_type1_ioctl_rsp *obj_buf; struct ksmbd_file *fp; - if (out_buf_len < sizeof(struct file_object_buf_type1_ioctl_rsp)) { - ret = -EINVAL; - goto out; - } - fp = ksmbd_lookup_fd_fast(work, id); if (!fp) { ret = -EBADF; rsp->hdr.Status = STATUS_FILE_CLOSED; goto out2; } + + if (out_buf_len < sizeof(struct file_object_buf_type1_ioctl_rsp)) { + ksmbd_fd_put(work, fp); + ret = -EINVAL; + goto out; + } ksmbd_fd_put(work, fp); nbytes = sizeof(struct file_object_buf_type1_ioctl_rsp);