Skip to content

Commit 90f7c10

Browse files
pcacjrsmfrench
authored andcommitted
smb: client: fix compound alignment with encryption
The encryption layer can't handle the padding iovs, so flatten the compound request into a single buffer with required padding to prevent the server from dropping the connection when finding unaligned compound requests. Fixes: bc925c1 ("smb: client: improve compound padding in encryption") Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Reviewed-by: David Howells <dhowells@redhat.com> Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French <stfrench@microsoft.com>
1 parent 76eeb9b commit 90f7c10

File tree

1 file changed

+25
-3
lines changed

1 file changed

+25
-3
lines changed

fs/smb/client/smb2ops.c

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2640,13 +2640,35 @@ smb2_set_next_command(struct cifs_tcon *tcon, struct smb_rqst *rqst)
26402640
}
26412641

26422642
/* SMB headers in a compound are 8 byte aligned. */
2643-
if (!IS_ALIGNED(len, 8)) {
2644-
num_padding = 8 - (len & 7);
2643+
if (IS_ALIGNED(len, 8))
2644+
goto out;
2645+
2646+
num_padding = 8 - (len & 7);
2647+
if (smb3_encryption_required(tcon)) {
2648+
int i;
2649+
2650+
/*
2651+
* Flatten request into a single buffer with required padding as
2652+
* the encryption layer can't handle the padding iovs.
2653+
*/
2654+
for (i = 1; i < rqst->rq_nvec; i++) {
2655+
memcpy(rqst->rq_iov[0].iov_base +
2656+
rqst->rq_iov[0].iov_len,
2657+
rqst->rq_iov[i].iov_base,
2658+
rqst->rq_iov[i].iov_len);
2659+
rqst->rq_iov[0].iov_len += rqst->rq_iov[i].iov_len;
2660+
}
2661+
memset(rqst->rq_iov[0].iov_base + rqst->rq_iov[0].iov_len,
2662+
0, num_padding);
2663+
rqst->rq_iov[0].iov_len += num_padding;
2664+
rqst->rq_nvec = 1;
2665+
} else {
26452666
rqst->rq_iov[rqst->rq_nvec].iov_base = smb2_padding;
26462667
rqst->rq_iov[rqst->rq_nvec].iov_len = num_padding;
26472668
rqst->rq_nvec++;
2648-
len += num_padding;
26492669
}
2670+
len += num_padding;
2671+
out:
26502672
shdr->NextCommand = cpu_to_le32(len);
26512673
}
26522674

0 commit comments

Comments
 (0)