ksmbd: Use unsafe_memcpy() for ntlm_negotiate

commit dfd046d0ced19b6ff5f11ec4ceab0a83de924771 upstream.

rsp buffer is allocated larger than spnego_blob from
smb2_allocate_rsp_buf().

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 185f7e0744f8a8c8f928ceddd3a0e05b15633662..9edf84da099f4b79d5b1b9ac8fa02fc858eac0f0 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1380,7 +1380,8 @@ static int ntlm_negotiate(struct ksmbd_work *work,
        }
 
        sz = le16_to_cpu(rsp->SecurityBufferOffset);
-       memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len);
+       unsafe_memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len,
+                       /* alloc is larger than blob, see smb2_allocate_rsp_buf() */);
        rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
 
 out:
@@ -1463,7 +1464,9 @@ static int ntlm_authenticate(struct ksmbd_work *work,
                        return -ENOMEM;
 
                sz = le16_to_cpu(rsp->SecurityBufferOffset);
-               memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len);
+               unsafe_memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob,
+                               spnego_blob_len,
+                               /* alloc is larger than blob, see smb2_allocate_rsp_buf() */);
                rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
                kfree(spnego_blob);
        }