ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount

smb2_lock() performs O(N^2) conflict detection with no cap on LockCount.
Cap lock_count at 64 to prevent CPU exhaustion from a single request.

Signed-off-by: Akif Sait <akif.sait111@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index a5d9a56cdee85dcc9288614f01e9f815fe1d074d..1ed44ed1aaebdc2d07e41f5dfc5a6660d7148aac 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7491,7 +7491,12 @@ int smb2_lock(struct ksmbd_work *work)
        lock_ele = req->locks;
 
        ksmbd_debug(SMB, "lock count is %d\n", lock_count);
-       if (!lock_count) {
+       /*
+        * Cap lock_count at 64. The MS-SMB2 spec defines Open.LockSequenceArray
+        * as exactly 64 entries so 64 is the intended ceiling. No real workload
+        * comes close to this in a single request.
+        */
+       if (!lock_count || lock_count > 64) {
                err = -EINVAL;
                goto out2;
        }