[PATCH v2 13/14] smb: server: use smb_decompress_alloc_size() in ksmbd_decompress_request()
Enzo Matsumiya <[email protected]> Mon, 20 Jul 2026 16:49:24 -0300
| Newsgroups | org.kernel.vger.linux-cifs |
|---|---|
| Message-ID | <[email protected]> |
Use common helper to validate compress header and get decompressed size. Signed-off-by: Enzo Matsumiya <[email protected]> --- fs/smb/server/compress.c | 27 ++++++--------------------- 1 file changed, 6 insertions(+), 21 deletions(-) diff --git a/fs/smb/server/compress.c b/fs/smb/server/compress.c index 46974499dddf..485caae4c038 100644 --- a/fs/smb/server/compress.c +++ b/fs/smb/server/compress.c @@ -24,11 +24,9 @@ */ int ksmbd_decompress_request(struct ksmbd_conn *conn) { - struct smb2_compression_hdr *hdr; unsigned int pdu_size = get_rfc1002_len(conn->request_buf); - u32 orig_size, offset, out_size; - u32 max_allowed_pdu_size; char *buf, *out; + u32 out_size; int rc; if (pdu_size < sizeof(struct smb2_compression_hdr)) @@ -38,30 +36,17 @@ int ksmbd_decompress_request(struct ksmbd_conn *conn) !smb_compress_alg_valid(conn->compress_algorithm, false)) return -EINVAL; - hdr = smb_get_msg(conn->request_buf); - if (hdr->ProtocolId != SMB2_COMPRESSION_TRANSFORM_ID) - return -EINVAL; - - orig_size = le32_to_cpu(hdr->OriginalCompressedSegmentSize); - if (hdr->Flags == cpu_to_le16(SMB2_COMPRESSION_FLAG_CHAINED)) { - out_size = orig_size; - } else { - offset = le32_to_cpu(hdr->Offset); - if (offset > pdu_size - sizeof(*hdr) || - check_add_overflow(orig_size, offset, &out_size)) - return -EINVAL; - } - - max_allowed_pdu_size = SMB3_MAX_MSGSIZE + conn->vals->max_write_size; - if (out_size > max_allowed_pdu_size || - out_size > MAX_STREAM_PROT_LEN) + buf = smb_get_msg(conn->request_buf); + out_size = smb_decompress_alloc_size(buf, pdu_size, 0, + SMB3_MAX_MSGSIZE + conn->vals->max_write_size, + conn->compress_chained); + if (out_size == 0 || out_size > MAX_STREAM_PROT_LEN) return -EINVAL; out = kvmalloc(out_size + 4 + 1, KSMBD_DEFAULT_GFP); if (!out) return -ENOMEM; - buf = (char *)hdr; *(__be32 *)out = cpu_to_be32(out_size); rc = smb_compression_decompress(conn->compress_algorithm, conn->compress_chained, -- 2.54.0