diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2026-07-12 14:31:02 +0900 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2026-08-17 15:00:46 +0900 |
| commit | dd562212178ef7bcd24e17efff172143fe2b705e (patch) | |
| tree | 2f9cf55e665a5a7df0939d802fb63a5662d357f2 | |
| parent | 8dd5ca858d26f947c59297ba96a8446a11d7aebf (diff) | |
| download | linux-dd562212178ef7bcd24e17efff172143fe2b705e.tar.gz linux-dd562212178ef7bcd24e17efff172143fe2b705e.zip | |
ksmbd: validate object id handles before response buffers
FSCTL_CREATE_OR_GET_OBJECT_ID requires a fixed-size output buffer, but an
invalid file handle must take precedence over output buffer validation.
Look up the handle before checking the available response buffer size. This
returns STATUS_FILE_CLOSED for a closed handle while preserving the buffer
size validation for valid handles.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 685746c2b501..39ed43214aa5 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -9615,17 +9615,18 @@ int smb2_ioctl(struct ksmbd_work *work) struct file_object_buf_type1_ioctl_rsp *obj_buf; struct ksmbd_file *fp; - if (out_buf_len < sizeof(struct file_object_buf_type1_ioctl_rsp)) { - ret = -EINVAL; - goto out; - } - fp = ksmbd_lookup_fd_fast(work, id); if (!fp) { ret = -EBADF; rsp->hdr.Status = STATUS_FILE_CLOSED; goto out2; } + + if (out_buf_len < sizeof(struct file_object_buf_type1_ioctl_rsp)) { + ksmbd_fd_put(work, fp); + ret = -EINVAL; + goto out; + } ksmbd_fd_put(work, fp); nbytes = sizeof(struct file_object_buf_type1_ioctl_rsp); |