linux-kernel - Re: [PATCH] ksmbd: Fix to handle removal of rfc1002 header from smb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cb002f72-3e2a-4d23-b08d-f6d987a29661@linux.dev>
Date: Thu, 18 Dec 2025 23:46:50 +0800
From: ChenXiaoSong <chenxiaosong.chenxiaosong@...ux.dev>
To: David Howells <dhowells@...hat.com>, Namjae Jeon <linkinjeon@...nel.org>,
 Steve French <sfrench@...ba.org>
Cc: Sergey Senozhatsky <senozhatsky@...omium.org>, Tom Talpey
 <tom@...pey.com>, Paulo Alcantara <pc@...guebit.org>,
 Shyam Prasad N <sprasad@...rosoft.com>, linux-cifs@...r.kernel.org,
 netfs@...ts.linux.dev, linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ksmbd: Fix to handle removal of rfc1002 header from
 smb_hdr

Hi David,

Since the size of `struct smb_hdr` has changed, the value of 
`SMB1_MIN_SUPPORTED_HEADER_SIZE` should also be updated to 
`(sizeof(struct smb_hdr) + 4)`. `SMB1_MIN_SUPPORTED_HEADER_SIZE` is used 
in `ksmbd_conn_handler_loop()`.

Thanks,
ChenXiaoSong.

On 12/18/25 11:09 PM, ChenXiaoSong wrote:
> `ksmbd_conn_handler_loop()` calls `get_rfc1002_len()`. Does this need to 
> be updated as well?
> 
> Thanks,
> ChenXiaoSong.
> 
> On 12/18/25 10:48 PM, David Howells wrote:
>> Hi Namjae,
>>
>> Does this (untested) patch fix the problem for you?
>>
>> David
>> ---
>> The commit that removed the RFC1002 header from struct smb_hdr didn't 
>> also
>> fix the places in ksmbd that use it in order to provide graceful 
>> rejection
>> of SMB1 protocol requests.
>>
>> Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
>> Reported-by: Namjae Jeon <linkinjeon@...nel.org>
>> Link: https://lore.kernel.org/r/ 
>> CAKYAXd9Ju4MFkkH5Jxfi1mO0AWEr=R35M3vQ_Xa7Yw34JoNZ0A@...l.gmail.com/
>> Signed-off-by: David Howells <dhowells@...hat.com>
>> cc: Steve French <sfrench@...ba.org>
>> cc: Sergey Senozhatsky <senozhatsky@...omium.org>
>> cc: Tom Talpey <tom@...pey.com>
>> cc: Paulo Alcantara <pc@...guebit.org>
>> cc: Shyam Prasad N <sprasad@...rosoft.com>
>> cc: linux-cifs@...r.kernel.org
>> cc: netfs@...ts.linux.dev
>> cc: linux-fsdevel@...r.kernel.org
>> ---
>>   fs/smb/server/server.c     |    2 +-
>>   fs/smb/server/smb_common.c |   10 +++++-----
>>   2 files changed, 6 insertions(+), 6 deletions(-)
>>
>> diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
>> index 3cea16050e4f..bedc8390b6db 100644
>> --- a/fs/smb/server/server.c
>> +++ b/fs/smb/server/server.c
>> @@ -95,7 +95,7 @@ static inline int check_conn_state(struct ksmbd_work 
>> *work)
>>       if (ksmbd_conn_exiting(work->conn) ||
>>           ksmbd_conn_need_reconnect(work->conn)) {
>> -        rsp_hdr = work->response_buf;
>> +        rsp_hdr = smb2_get_msg(work->response_buf);
>>           rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED;
>>           return 1;
>>       }
>> diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
>> index b23203a1c286..d6084580b59d 100644
>> --- a/fs/smb/server/smb_common.c
>> +++ b/fs/smb/server/smb_common.c
>> @@ -140,7 +140,7 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work)
>>       if (smb2_hdr->ProtocolId == SMB2_PROTO_NUMBER)
>>           return ksmbd_smb2_check_message(work);
>> -    hdr = work->request_buf;
>> +    hdr = smb2_get_msg(work->request_buf);
>>       if (*(__le32 *)hdr->Protocol == SMB1_PROTO_NUMBER &&
>>           hdr->Command == SMB_COM_NEGOTIATE) {
>>           work->conn->outstanding_credits++;
>> @@ -278,7 +278,6 @@ static int ksmbd_negotiate_smb_dialect(void *buf)
>>                             req->DialectCount);
>>       }
>> -    proto = *(__le32 *)((struct smb_hdr *)buf)->Protocol;
>>       if (proto == SMB1_PROTO_NUMBER) {
>>           struct smb_negotiate_req *req;
>> @@ -320,8 +319,8 @@ static u16 get_smb1_cmd_val(struct ksmbd_work *work)
>>    */
>>   static int init_smb1_rsp_hdr(struct ksmbd_work *work)
>>   {
>> -    struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
>> -    struct smb_hdr *rcv_hdr = (struct smb_hdr *)work->request_buf;
>> +    struct smb_hdr *rsp_hdr = (struct smb_hdr *)smb2_get_msg(work- 
>> >response_buf);
>> +    struct smb_hdr *rcv_hdr = (struct smb_hdr *)smb2_get_msg(work- 
>> >request_buf);
>>       rsp_hdr->Command = SMB_COM_NEGOTIATE;
>>       *(__le32 *)rsp_hdr->Protocol = SMB1_PROTO_NUMBER;
>> @@ -412,9 +411,10 @@ static int init_smb1_server(struct ksmbd_conn *conn)
>>   int ksmbd_init_smb_server(struct ksmbd_conn *conn)
>>   {
>> +    struct smb_hdr *rcv_hdr = (struct smb_hdr *)smb2_get_msg(conn- 
>> >request_buf);
>>       __le32 proto;
>> -    proto = *(__le32 *)((struct smb_hdr *)conn->request_buf)->Protocol;
>> +    proto = *(__le32 *)rcv_hdr->Protocol;
>>       if (conn->need_neg == false) {
>>           if (proto == SMB1_PROTO_NUMBER)
>>               return -EINVAL;
>>
>>
>