[PATCH] ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount

[PATCH] ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount

[Akif Sait]

smb2_lock() performs O(N^2) conflict detection with no cap on LockCount.
Cap lock_count at 64 to prevent CPU exhaustion from a single request.

Signed-off-by: Akif Sait <akif.sait111@gmail.com>
---
Hi Namjae, Steve,

smb2_lock processes LockCount lock elements using a nested loop where
each element checks all previous elements for conflicts. With no cap on
LockCount a single authenticated request with LockCount=65535 results in
roughly 2.1 billion iterations inside a ksmbd worker thread, pinning the
CPU completely. A few concurrent requests hang the host entirely.

Cap lock_count at 64. The MS-SMB2 spec defines Open.LockSequenceArray
as exactly 64 entries so 64 is the intended ceiling. No real workload
comes close to this in a single request.

Let me know if you need more info or a reproducer.

Thanks,
Akif


 fs/smb/server/smb2pdu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index ee32e61b6d3c..012f0c3585a0 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7492,7 +7492,7 @@ int smb2_lock(struct ksmbd_work *work)
 	lock_ele = req->locks;
 
 	ksmbd_debug(SMB, "lock count is %d\n", lock_count);
-	if (!lock_count) {
+	if (!lock_count || lock_count > 64) {
 		err = -EINVAL;
 		goto out2;
 	}
-- 
2.53.0