Re: replace for-next-next... Re: [PATCH v4 000/142] smb: smbdirect/client/server: make use of common structures

[Steve French <smfrench@gmail.com>]

updated cifs-2.6.git for-next with the client patch

On Wed, Sep 10, 2025 at 6:36 PM Namjae Jeon <linkinjeon@kernel.org> wrote:
>
> On Thu, Sep 11, 2025 at 4:05 AM Stefan Metzmacher <metze@samba.org> wrote:
> >
> > Hi Steve, hi Namjae,
> Hi Metze,
> >
> > I found "ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer"
> > https://git.samba.org/?p=ksmbd.git;a=commitdiff;h=927f8fe05e334d016c598d2cc965161c2808d9ba
> > in ksmbd-for-next-next.
> >
> > I added a Fixes and Reviewed-by tag
> > https://git.samba.org/?p=metze/linux/wip.git;a=commitdiff;h=fa36db4e8d62aa9c3ba1200323d8e01e4eb88b19
> > and two additional patches:
> I will update it with your tags.
> > ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
> > https://git.samba.org/?p=metze/linux/wip.git;a=commitdiff;h=9e881174900e53dd2b17c0c0933cc4395ceb47a6
> Looks good to me. I will apply it to #ksmbd-for-next-next.
>
> > smb: client: let recv_done verify data_offset, data_length and remaining_data_length
> > https://git.samba.org/?p=metze/linux/wip.git;a=commitdiff;h=174faeea9ee496b724206d405b74db8b05729f11
> Looks good to me. Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> for
> this client patch.
>
> Thanks!
> >
> > I think these should go into 6.17.
> >
> > As there as conflicts with for-next-next I rebased it again
> > and made sure each commit compiles and the result still passes
> > the tests I made last time.
> >
> > The result can be found under
> > git fetch https://git.samba.org/metze/linux/wip.git for-6.18/fs-smb-20250910-v6
> > https://git.samba.org/?p=metze/linux/wip.git;a=shortlog;h=refs/heads/for-6.18/fs-smb-20250910-v6
> >
> > Please have a look and replace for-next-next again...
> > The diff against the current for-next-next (e2e99af785ee91ce20c6d583e396660494db77a2)
> > and for-6.18/fs-smb-20250910-v6 (1fb2a52741e836f54a4691cbd74d9d70d736e506) follows below.
> >
> > Thanks!
> > metze
> >
> >   fs/smb/client/smbdirect.c                  | 19 ++++++++++++++++++-
> >   fs/smb/common/smbdirect/smbdirect_socket.h |  2 +-
> >   fs/smb/server/transport_rdma.c             | 25 +++++++++++++++++--------
> >   3 files changed, 36 insertions(+), 10 deletions(-)
> >
> > diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
> > index 322334097e30..6215a6e91c67 100644
> > --- a/fs/smb/client/smbdirect.c
> > +++ b/fs/smb/client/smbdirect.c
> > @@ -548,7 +548,9 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
> >         struct smbdirect_socket *sc = response->socket;
> >         struct smbdirect_socket_parameters *sp = &sc->parameters;
> >         u16 old_recv_credit_target;
> > -       int data_length = 0;
> > +       u32 data_offset = 0;
> > +       u32 data_length = 0;
> > +       u32 remaining_data_length = 0;
> >         bool negotiate_done = false;
> >
> >         log_rdma_recv(INFO,
> > @@ -600,7 +602,22 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
> >         /* SMBD data transfer packet */
> >         case SMBDIRECT_EXPECT_DATA_TRANSFER:
> >                 data_transfer = smbdirect_recv_io_payload(response);
> > +
> > +               if (wc->byte_len <
> > +                   offsetof(struct smbdirect_data_transfer, padding))
> > +                       goto error;
> > +
> > +               remaining_data_length = le32_to_cpu(data_transfer->remaining_data_length);
> > +               data_offset = le32_to_cpu(data_transfer->data_offset);
> >                 data_length = le32_to_cpu(data_transfer->data_length);
> > +               if (wc->byte_len < data_offset ||
> > +                   wc->byte_len < (u64)data_offset + data_length)
> > +                       goto error;
> > +
> > +               if (remaining_data_length > sp->max_fragmented_recv_size ||
> > +                   data_length > sp->max_fragmented_recv_size ||
> > +                   (u64)remaining_data_length + (u64)data_length > (u64)sp->max_fragmented_recv_size)
> > +                       goto error;
> >
> >                 if (data_length) {
> >                         if (sc->recv_io.reassembly.full_packet_received)
> > diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h
> > index 8542de12002a..91eb02fb1600 100644
> > --- a/fs/smb/common/smbdirect/smbdirect_socket.h
> > +++ b/fs/smb/common/smbdirect/smbdirect_socket.h
> > @@ -63,7 +63,7 @@ const char *smbdirect_socket_status_string(enum smbdirect_socket_status status)
> >         case SMBDIRECT_SOCKET_DISCONNECTING:
> >                 return "DISCONNECTING";
> >         case SMBDIRECT_SOCKET_DISCONNECTED:
> > -               return "DISCONNECTED,";
> > +               return "DISCONNECTED";
> >         case SMBDIRECT_SOCKET_DESTROYED:
> >                 return "DESTROYED";
> >         }
> > diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
> > index 33d2f5bdb827..e371d8f4c80b 100644
> > --- a/fs/smb/server/transport_rdma.c
> > +++ b/fs/smb/server/transport_rdma.c
> > @@ -538,7 +538,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
> >         case SMBDIRECT_EXPECT_DATA_TRANSFER: {
> >                 struct smbdirect_data_transfer *data_transfer =
> >                         (struct smbdirect_data_transfer *)recvmsg->packet;
> > -               unsigned int data_length;
> > +               u32 remaining_data_length, data_offset, data_length;
> >                 u16 old_recv_credit_target;
> >
> >                 if (wc->byte_len <
> > @@ -548,15 +548,24 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
> >                         return;
> >                 }
> >
> > +               remaining_data_length = le32_to_cpu(data_transfer->remaining_data_length);
> >                 data_length = le32_to_cpu(data_transfer->data_length);
> > -               if (data_length) {
> > -                       if (wc->byte_len < sizeof(struct smbdirect_data_transfer) +
> > -                           (u64)data_length) {
> > -                               put_recvmsg(sc, recvmsg);
> > -                               smb_direct_disconnect_rdma_connection(sc);
> > -                               return;
> > -                       }
> > +               data_offset = le32_to_cpu(data_transfer->data_offset);
> > +               if (wc->byte_len < data_offset ||
> > +                   wc->byte_len < (u64)data_offset + data_length) {
> > +                       put_recvmsg(sc, recvmsg);
> > +                       smb_direct_disconnect_rdma_connection(sc);
> > +                       return;
> > +               }
> > +               if (remaining_data_length > sp->max_fragmented_recv_size ||
> > +                   data_length > sp->max_fragmented_recv_size ||
> > +                   (u64)remaining_data_length + (u64)data_length > (u64)sp->max_fragmented_recv_size) {
> > +                       put_recvmsg(sc, recvmsg);
> > +                       smb_direct_disconnect_rdma_connection(sc);
> > +                       return;
> > +               }
> >
> > +               if (data_length) {
> >                         if (sc->recv_io.reassembly.full_packet_received)
> >                                 recvmsg->first_segment = true;
> >
> >
> >
> >



-- 
Thanks,

Steve