Commit bd0a1ca5 authored by Akif Sait's avatar Akif Sait Committed by Steve French
Browse files

ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount 



smb2_lock() performs O(N^2) conflict detection with no cap on LockCount.
Cap lock_count at 64 to prevent CPU exhaustion from a single request.

Signed-off-by: default avatarAkif Sait <akif.sait111@gmail.com>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent b32c8db4

fs/smb/server/smb2pdu.c

+6 −1
Original line number Diff line number Diff line
@@ -7491,7 +7491,12 @@ int smb2_lock(struct ksmbd_work *work) 
	lock_ele = req->locks;



	ksmbd_debug(SMB, "lock count is %d\n", lock_count);

	if (!lock_count) {

	/*

	 * Cap lock_count at 64. The MS-SMB2 spec defines Open.LockSequenceArray

	 * as exactly 64 entries so 64 is the intended ceiling. No real workload

	 * comes close to this in a single request.

	 */

	if (!lock_count || lock_count > 64) {

		err = -EINVAL;

		goto out2;

	}