diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2024-06-10 17:06:19 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-06-12 07:43:09 +0300 |
| commit | 1cdeca6a7264021e20157de0baf7880ff0ced822 (patch) | |
| tree | 7081b6166e488d601f8955946ef463e71438911b | |
| parent | 83a7eefedc9b56fe7bfeff13b6c7356688ffa670 (diff) | |
| download | linux-1cdeca6a7264021e20157de0baf7880ff0ced822.tar.xz | |
ksmbd: move leading slash check to smb2_get_name()
If the directory name in the root of the share starts with
character like ้(0x955c) or แน(0x1e5c), it (and anything inside)
cannot be accessed. The leading slash check must be checked after
converting unicode to nls string.
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 15 |
1 files changed, 6 insertions, 9 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index b6c5a8ea3887..f79d06d2d655 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -630,6 +630,12 @@ smb2_get_name(const char *src, const int maxlen, struct nls_table *local_nls) return name; } + if (*name == '\\') { + pr_err("not allow directory name included leading slash\n"); + kfree(name); + return ERR_PTR(-EINVAL); + } + ksmbd_conv_path_to_unix(name); ksmbd_strip_last_slash(name); return name; @@ -2842,20 +2848,11 @@ int smb2_open(struct ksmbd_work *work) } if (req->NameLength) { - if ((req->CreateOptions & FILE_DIRECTORY_FILE_LE) && - *(char *)req->Buffer == '\\') { - pr_err("not allow directory name included leading slash\n"); - rc = -EINVAL; - goto err_out2; - } - name = smb2_get_name((char *)req + le16_to_cpu(req->NameOffset), le16_to_cpu(req->NameLength), work->conn->local_nls); if (IS_ERR(name)) { rc = PTR_ERR(name); - if (rc != -ENOMEM) - rc = -ENOENT; name = NULL; goto err_out2; } |