Re: [BUG] null-ptr-deref on ksmbd-for-next-next branch

Hi ChenXiaoSong,

First, Thanks for the report and check!
> --- a/fs/smb/server/server.c
> +++ b/fs/smb/server/server.c
> @@ -140,7 +140,8 @@ static int __process_request(struct ksmbd_work
> *work, struct ksmbd_conn *conn,
>                  return SERVER_HANDLER_ABORT;
>          }
>
> -       signed_req = conn->ops->is_sign_req(work, command);
> +       signed_req = work->sess &&
> +                    conn->ops->is_sign_req(work, command);
I don't understand why work->sess needs to be checked here. IIUC, the
crash occurs because conn->ops->is_sign_req is NULL when Windows
client sends an initial SMB1 negotiate request. If so, wouldn't
checking the callback directly make the intent clearer?
+       signed_req = conn->ops->is_sign_req &&
                               conn->ops->is_sign_req(work, command);

>          if (work->sess && work->sess->sign && !work->encrypted &&
>              !signed_req) {
>                  conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
> ```
>
> If you want, you can add:
>
> Tested-by: ChenXiaoSong <[email protected]>
> Reviewed-by: ChenXiaoSong <[email protected]>
Sure, I will add them if you confirm it.

Thanks again!
>
> --
> ChenXiaoSong <[email protected]>
> Chinese Homepage: https://chenxiaosong.com
> English Homepage: https://chenxiaosong.com/en
>