diff options
| author | Akif Sait <akif.sait111@gmail.com> | 2026-04-20 04:58:26 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2026-04-22 16:11:23 +0300 |
| commit | bd0a1ca52b6da64b1a163f103b28b488b20497fe (patch) | |
| tree | d8bcc1285a0d33a09eafdc035ef96497297b0a88 | |
| parent | b32c8db48212a34998c36d0bbc05b29d5c407ef5 (diff) | |
| download | linux-bd0a1ca52b6da64b1a163f103b28b488b20497fe.tar.xz | |
ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount
smb2_lock() performs O(N^2) conflict detection with no cap on LockCount.
Cap lock_count at 64 to prevent CPU exhaustion from a single request.
Signed-off-by: Akif Sait <akif.sait111@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index a5d9a56cdee8..1ed44ed1aaeb 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -7491,7 +7491,12 @@ int smb2_lock(struct ksmbd_work *work) lock_ele = req->locks; ksmbd_debug(SMB, "lock count is %d\n", lock_count); - if (!lock_count) { + /* + * Cap lock_count at 64. The MS-SMB2 spec defines Open.LockSequenceArray + * as exactly 64 entries so 64 is the intended ceiling. No real workload + * comes close to this in a single request. + */ + if (!lock_count || lock_count > 64) { err = -EINVAL; goto out2; } |