| Message ID | 20220516074140.28522-1-linkinjeon@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | [1/3] ksmbd: handle smb2 query dir request for OutputBufferLength that is too small | expand |
2022년 5월 16일 (월) 오후 4:42, Namjae Jeon <linkinjeon@kernel.org>님이 작성: > > We found the issue that ksmbd return STATUS_NO_MORE_FILES response > even though there are still dentries that needs to be read while > file read/write test using framtest utils. > windows client send smb2 query dir request included > OutputBufferLength(128) that is too small to contain even one entry. > This patch make ksmbd immediately returns OutputBufferLength of response > as zero to client. > > Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> > --- Looks good to me. Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> > fs/ksmbd/smb2pdu.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c > index 10b7052e382f..eb7ca5f24a3b 100644 > --- a/fs/ksmbd/smb2pdu.c > +++ b/fs/ksmbd/smb2pdu.c > @@ -3938,6 +3938,12 @@ int smb2_query_dir(struct ksmbd_work *work) > set_ctx_actor(&dir_fp->readdir_data.ctx, __query_dir); > > rc = iterate_dir(dir_fp->filp, &dir_fp->readdir_data.ctx); > + /* > + * req->OutputBufferLength is too small to contain even one entry. > + * In this case, it immediately returns OutputBufferLength 0 to client. > + */ > + if (!d_info.out_buf_len && !d_info.num_entry) > + goto no_buf_len; > if (rc == 0) > restart_ctx(&dir_fp->readdir_data.ctx); > if (rc == -ENOSPC) > @@ -3964,10 +3970,12 @@ int smb2_query_dir(struct ksmbd_work *work) > rsp->Buffer[0] = 0; > inc_rfc1001_len(work->response_buf, 9); > } else { > +no_buf_len: > ((struct file_directory_info *) > ((char *)rsp->Buffer + d_info.last_entry_offset)) > ->NextEntryOffset = 0; > - d_info.data_count -= d_info.last_entry_off_align; > + if (d_info.data_count >= d_info.last_entry_off_align) > + d_info.data_count -= d_info.last_entry_off_align; > > rsp->StructureSize = cpu_to_le16(9); > rsp->OutputBufferOffset = cpu_to_le16(72); > -- > 2.25.1 >
diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 10b7052e382f..eb7ca5f24a3b 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -3938,6 +3938,12 @@ int smb2_query_dir(struct ksmbd_work *work) set_ctx_actor(&dir_fp->readdir_data.ctx, __query_dir); rc = iterate_dir(dir_fp->filp, &dir_fp->readdir_data.ctx); + /* + * req->OutputBufferLength is too small to contain even one entry. + * In this case, it immediately returns OutputBufferLength 0 to client. + */ + if (!d_info.out_buf_len && !d_info.num_entry) + goto no_buf_len; if (rc == 0) restart_ctx(&dir_fp->readdir_data.ctx); if (rc == -ENOSPC) @@ -3964,10 +3970,12 @@ int smb2_query_dir(struct ksmbd_work *work) rsp->Buffer[0] = 0; inc_rfc1001_len(work->response_buf, 9); } else { +no_buf_len: ((struct file_directory_info *) ((char *)rsp->Buffer + d_info.last_entry_offset)) ->NextEntryOffset = 0; - d_info.data_count -= d_info.last_entry_off_align; + if (d_info.data_count >= d_info.last_entry_off_align) + d_info.data_count -= d_info.last_entry_off_align; rsp->StructureSize = cpu_to_le16(9); rsp->OutputBufferOffset = cpu_to_le16(72);
We found the issue that ksmbd return STATUS_NO_MORE_FILES response even though there are still dentries that needs to be read while file read/write test using framtest utils. windows client send smb2 query dir request included OutputBufferLength(128) that is too small to contain even one entry. This patch make ksmbd immediately returns OutputBufferLength of response as zero to client. Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> --- fs/ksmbd/smb2pdu.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)