samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ksmbd: remove unsafe_memcpy use in session setup

Browse Source 
commit d782d6e1d9078d6b82f8468dd6421050165e7d75 upstream.

Kees pointed out to just use directly ->Buffer instead of pointing
->Buffer using offset not to use unsafe_memcpy().

Suggested-by: Kees Cook <kees@kernel.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Namjae Jeon
2024-09-23 22:39:11 +09:00
committed by Greg Kroah-Hartman
parent 107a48df3f
commit b90dc5d67b
1 changed files with 3 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
fs/smb/server/smb2pdu.c
View File

@@ -1345,8 +1345,7 @@ static int ntlm_negotiate(struct ksmbd_work *work,
return rc; return rc;
sz = le16_to_cpu(rsp->SecurityBufferOffset); sz = le16_to_cpu(rsp->SecurityBufferOffset);
chgblob = chgblob = (struct challenge_message *)rsp->Buffer;
(struct challenge_message *)((char *)&rsp->hdr.ProtocolId + sz);
memset(chgblob, 0, sizeof(struct challenge_message)); memset(chgblob, 0, sizeof(struct challenge_message));
if (!work->conn->use_spnego) { if (!work->conn->use_spnego) {
@@ -1379,9 +1378,7 @@ static int ntlm_negotiate(struct ksmbd_work *work,
goto out; goto out;
} }
sz = le16_to_cpu(rsp->SecurityBufferOffset); memcpy(rsp->Buffer, spnego_blob, spnego_blob_len);
unsafe_memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len,
/* alloc is larger than blob, see smb2_allocate_rsp_buf() */);
rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
out: out:
@@ -1463,10 +1460,7 @@ static int ntlm_authenticate(struct ksmbd_work *work,
if (rc) if (rc)
return -ENOMEM; return -ENOMEM;
sz = le16_to_cpu(rsp->SecurityBufferOffset); memcpy(rsp->Buffer, spnego_blob, spnego_blob_len);
unsafe_memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob,
spnego_blob_len,
/* alloc is larger than blob, see smb2_allocate_rsp_buf() */);
rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
kfree(spnego_blob); kfree(spnego_blob);
} }