ksmbd: fix stream write failure

If there is no stream data in file, v_len is zero.
So, If position(*pos) is zero, stream write will fail
due to stream write position validation check.
This patch reorganize stream write position validation.

Fixes: 0ca6df4f40cf ("ksmbd: prevent out-of-bounds stream writes by validating *pos")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 482eba0f4dc11a7eebcffe5a5e1805549642a32b..156ded9ac889bd89b71ae321715b18f1c7a9f7ef 100644 (file)
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -409,10 +409,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
        ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n",
                    *pos, count);
 
+       if (*pos >= XATTR_SIZE_MAX) {
+               pr_err("stream write position %lld is out of bounds\n", *pos);
+               return -EINVAL;
+       }
+
        size = *pos + count;
        if (size > XATTR_SIZE_MAX) {
                size = XATTR_SIZE_MAX;
-               count = (*pos + count) - XATTR_SIZE_MAX;
+               count = XATTR_SIZE_MAX - *pos;
        }
 
        v_len = ksmbd_vfs_getcasexattr(idmap,
@@ -426,13 +431,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
                goto out;
        }
 
-       if (v_len <= *pos) {
-               pr_err("stream write position %lld is out of bounds (stream length: %zd)\n",
-                               *pos, v_len);
-               err = -EINVAL;
-               goto out;
-       }
-
        if (v_len < size) {
                wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);
                if (!wbuf) {