Skip to content
This repository was archived by the owner on Nov 8, 2023. It is now read-only.

Commit 1cdeca6

Browse files
namjaejeonSteve French
authored andcommitted
ksmbd: move leading slash check to smb2_get_name()
If the directory name in the root of the share starts with character like 镜(0x955c) or Ṝ(0x1e5c), it (and anything inside) cannot be accessed. The leading slash check must be checked after converting unicode to nls string. Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
1 parent 83a7eef commit 1cdeca6

File tree

1 file changed

+6
-9
lines changed

1 file changed

+6
-9
lines changed

fs/smb/server/smb2pdu.c

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -630,6 +630,12 @@ smb2_get_name(const char *src, const int maxlen, struct nls_table *local_nls)
630630
return name;
631631
}
632632

633+
if (*name == '\\') {
634+
pr_err("not allow directory name included leading slash\n");
635+
kfree(name);
636+
return ERR_PTR(-EINVAL);
637+
}
638+
633639
ksmbd_conv_path_to_unix(name);
634640
ksmbd_strip_last_slash(name);
635641
return name;
@@ -2842,20 +2848,11 @@ int smb2_open(struct ksmbd_work *work)
28422848
}
28432849

28442850
if (req->NameLength) {
2845-
if ((req->CreateOptions & FILE_DIRECTORY_FILE_LE) &&
2846-
*(char *)req->Buffer == '\\') {
2847-
pr_err("not allow directory name included leading slash\n");
2848-
rc = -EINVAL;
2849-
goto err_out2;
2850-
}
2851-
28522851
name = smb2_get_name((char *)req + le16_to_cpu(req->NameOffset),
28532852
le16_to_cpu(req->NameLength),
28542853
work->conn->local_nls);
28552854
if (IS_ERR(name)) {
28562855
rc = PTR_ERR(name);
2857-
if (rc != -ENOMEM)
2858-
rc = -ENOENT;
28592856
name = NULL;
28602857
goto err_out2;
28612858
}

0 commit comments

Comments
 (0)