DF-0600 / valid_sa.c
/* Variant B: VALID sa_len to isolate whether smb_iod_request crash is * pre-existing (independent of the DF-0600 sa_len bug). Uses a proper * sockaddr_in (sa_len=16) with matching ioc_svlen=16, plus a local addr. */ #include <sys/types.h> #include <sys/ioctl.h> #include <sys/socket.h> #include <netinet/in.h> #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include "smb_dev.h" int main(void){ struct smbioc_ossn ssn; struct sockaddr_in sin, lin; int fd = open("/dev/nsmb", O_RDWR); if (fd<0){perror("open");return 2;} memset(&sin,0,sizeof(sin)); sin.sin_len=sizeof(sin); sin.sin_family=AF_INET; sin.sin_addr.s_addr=htonl(INADDR_LOOPBACK); memset(&lin,0,sizeof(lin)); lin.sin_len=sizeof(lin); lin.sin_family=AF_INET; memset(&ssn,0,sizeof(ssn)); ssn.ioc_opt=SMBVOPT_CREATE; ssn.ioc_server=(struct sockaddr*)&sin; ssn.ioc_svlen=sizeof(sin); ssn.ioc_local=(struct sockaddr*)&lin; ssn.ioc_lolen=sizeof(lin); ssn.ioc_timeout=1; ssn.ioc_retrycount=0; strlcpy(ssn.ioc_user,"t",sizeof(ssn.ioc_user)); strlcpy(ssn.ioc_localcs,"UTF-8",sizeof(ssn.ioc_localcs)); strlcpy(ssn.ioc_servercs,"UTF-8",sizeof(ssn.ioc_servercs)); printf("[*] VALID sa_len=%d svlen=%d\n", ssn.ioc_svlen, sin.sin_len); int rc=ioctl(fd,SMBIOC_OPENSESSION,&ssn); printf("[*] rc=%d errno=%d (%s)\n",rc,errno,rc?strerror(errno):"ok"); close(fd); return 0; } |