linux-kernel - Re: [PATCH] ksmbd: Fix to handle removal of rfc1002 header from smb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKYAXd_Yjc_ByJdbx6N++G6DT02WTXnPpw2rqW=cZgvoCns=Tw@mail.gmail.com>
Date: Fri, 19 Dec 2025 01:21:59 +0900
From: Namjae Jeon <linkinjeon@...nel.org>
To: David Howells <dhowells@...hat.com>
Cc: Steve French <sfrench@...ba.org>, Sergey Senozhatsky <senozhatsky@...omium.org>, 
	Tom Talpey <tom@...pey.com>, Paulo Alcantara <pc@...guebit.org>, 
	Shyam Prasad N <sprasad@...rosoft.com>, linux-cifs@...r.kernel.org, netfs@...ts.linux.dev, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ksmbd: Fix to handle removal of rfc1002 header from smb_hdr

On Thu, Dec 18, 2025 at 11:49 PM David Howells <dhowells@...hat.com> wrote:
>
> Hi Namjae,
Hi David,
>
> Does this (untested) patch fix the problem for you?
I sent the v2 patch to the list now.  I have tested it with cifs.ko
and windows clients.
Thanks!
>
> David
> ---
> The commit that removed the RFC1002 header from struct smb_hdr didn't also
> fix the places in ksmbd that use it in order to provide graceful rejection
> of SMB1 protocol requests.
>
> Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
> Reported-by: Namjae Jeon <linkinjeon@...nel.org>
> Link: https://lore.kernel.org/r/CAKYAXd9Ju4MFkkH5Jxfi1mO0AWEr=R35M3vQ_Xa7Yw34JoNZ0A@mail.gmail.com/
> Signed-off-by: David Howells <dhowells@...hat.com>
> cc: Steve French <sfrench@...ba.org>
> cc: Sergey Senozhatsky <senozhatsky@...omium.org>
> cc: Tom Talpey <tom@...pey.com>
> cc: Paulo Alcantara <pc@...guebit.org>
> cc: Shyam Prasad N <sprasad@...rosoft.com>
> cc: linux-cifs@...r.kernel.org
> cc: netfs@...ts.linux.dev
> cc: linux-fsdevel@...r.kernel.org
> ---
>  fs/smb/server/server.c     |    2 +-
>  fs/smb/server/smb_common.c |   10 +++++-----
>  2 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
> index 3cea16050e4f..bedc8390b6db 100644
> --- a/fs/smb/server/server.c
> +++ b/fs/smb/server/server.c
> @@ -95,7 +95,7 @@ static inline int check_conn_state(struct ksmbd_work *work)
>
>         if (ksmbd_conn_exiting(work->conn) ||
>             ksmbd_conn_need_reconnect(work->conn)) {
> -               rsp_hdr = work->response_buf;
> +               rsp_hdr = smb2_get_msg(work->response_buf);
>                 rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED;
>                 return 1;
>         }
> diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
> index b23203a1c286..d6084580b59d 100644
> --- a/fs/smb/server/smb_common.c
> +++ b/fs/smb/server/smb_common.c
> @@ -140,7 +140,7 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work)
>         if (smb2_hdr->ProtocolId == SMB2_PROTO_NUMBER)
>                 return ksmbd_smb2_check_message(work);
>
> -       hdr = work->request_buf;
> +       hdr = smb2_get_msg(work->request_buf);
>         if (*(__le32 *)hdr->Protocol == SMB1_PROTO_NUMBER &&
>             hdr->Command == SMB_COM_NEGOTIATE) {
>                 work->conn->outstanding_credits++;
> @@ -278,7 +278,6 @@ static int ksmbd_negotiate_smb_dialect(void *buf)
>                                                   req->DialectCount);
>         }
>
> -       proto = *(__le32 *)((struct smb_hdr *)buf)->Protocol;
>         if (proto == SMB1_PROTO_NUMBER) {
>                 struct smb_negotiate_req *req;
>
> @@ -320,8 +319,8 @@ static u16 get_smb1_cmd_val(struct ksmbd_work *work)
>   */
>  static int init_smb1_rsp_hdr(struct ksmbd_work *work)
>  {
> -       struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
> -       struct smb_hdr *rcv_hdr = (struct smb_hdr *)work->request_buf;
> +       struct smb_hdr *rsp_hdr = (struct smb_hdr *)smb2_get_msg(work->response_buf);
> +       struct smb_hdr *rcv_hdr = (struct smb_hdr *)smb2_get_msg(work->request_buf);
>
>         rsp_hdr->Command = SMB_COM_NEGOTIATE;
>         *(__le32 *)rsp_hdr->Protocol = SMB1_PROTO_NUMBER;
> @@ -412,9 +411,10 @@ static int init_smb1_server(struct ksmbd_conn *conn)
>
>  int ksmbd_init_smb_server(struct ksmbd_conn *conn)
>  {
> +       struct smb_hdr *rcv_hdr = (struct smb_hdr *)smb2_get_msg(conn->request_buf);
>         __le32 proto;
>
> -       proto = *(__le32 *)((struct smb_hdr *)conn->request_buf)->Protocol;
> +       proto = *(__le32 *)rcv_hdr->Protocol;
>         if (conn->need_neg == false) {
>                 if (proto == SMB1_PROTO_NUMBER)
>                         return -EINVAL;
>