linux-toradex.git/fs/smb, branch v6.14-rc6

cifs: fix incorrect validation for num_aces field of smb_acl

2025-03-03T04:50:54+00:00

parse_dcal() validate num_aces to allocate ace array.

f (num_aces > ULONG_MAX / sizeof(struct smb_ace *))

It is an incorrect validation that we can create an array of size ULONG_MAX.
smb_acl has ->size field to calculate actual number of aces in response buffer
size. Use this to check invalid num_aces.

Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix incorrect validation for num_aces field of smb_acl

2025-03-03T04:50:54+00:00

parse_dcal() validate num_aces to allocate posix_ace_state_array.

if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))

It is an incorrect validation that we can create an array of size ULONG_MAX.
smb_acl has ->size field to calculate actual number of aces in request buffer
size. Use this to check invalid num_aces.

Reported-by: Igor Leite Ladessa 
Tested-by: Igor Leite Ladessa 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

smb: common: change the data type of num_aces to le16

2025-03-03T04:50:54+00:00

2.4.5 in [MS-DTYP].pdf describe the data type of num_aces as le16.

AceCount (2 bytes): An unsigned 16-bit integer that specifies the count
of the number of ACE records in the ACL.

Change it to le16 and add reserved field to smb_acl struct.

Reported-by: Igor Leite Ladessa 
Tested-by: Igor Leite Ladessa 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix bug on trap in smb2_lock

2025-03-03T04:50:53+00:00

If lock count is greater than 1, flags could be old value.
It should be checked with flags of smb_lock, not flags.
It will cause bug-on trap from locks_free_lock in error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix use-after-free in smb2_lock

2025-03-03T04:50:53+00:00

If smb_lock->zero_len has value, ->llist of smb_lock is not delete and
flock is old one. It will cause use-after-free on error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

2025-03-03T04:50:53+00:00

req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on
ida_alloc. req->handle from ksmbd_ipc_login_request and
FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion
between messages, resulting in access to unexpected parts of memory after
an incorrect delivery. ksmbd check type of ipc response but missing add
continue to check next ipc reponse.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

ksmbd: fix out-of-bounds in parse_sec_desc()

2025-03-03T04:50:53+00:00

If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd
struct size. If it is smaller, It could cause slab-out-of-bounds.
And when validating sid, It need to check it included subauth array size.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei 
Tested-by: Norbert Szetei 
Signed-off-by: Namjae Jeon 
Signed-off-by: Steve French

cifs: Fix the smb1 readv callback to correctly call netfs

2025-02-26T00:35:23+00:00

Fix cifs_readv_callback() to call netfs_read_subreq_terminated() rather
than queuing the subrequest work item (which is unset).  Also call the
I/O progress tracepoint.

cc: Jeff Layton 
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item")
Reported-by: Jean-Christophe Guillain 
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219793
Tested-by: Jean-Christophe Guillain 
Tested-by: Pali Rohár 
Reviewed-by: Paulo Alcantara (Red Hat) 
Signed-off-by: David Howells 
Signed-off-by: Steve French

smb: client: Add check for next_buffer in receive_encrypted_standard()

2025-02-20T18:10:39+00:00

Add check for the return value of cifs_buf_get() and cifs_small_buf_get()
in receive_encrypted_standard() to prevent null pointer dereference.

Fixes: eec04ea11969 ("smb: client: fix OOB in receive_encrypted_standard()")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li 
Signed-off-by: Steve French

cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes

2025-02-19T16:42:27+00:00

If the reparse point was not handled (indicated by the -EOPNOTSUPP from
ops->parse_reparse_point() call) but reparse tag is of type name surrogate
directory type, then treat is as a new mount point.

Name surrogate reparse point represents another named entity in the system.

From SMB client point of view, this another entity is resolved on the SMB
server, and server serves its content automatically. Therefore from Linux
client point of view, this name surrogate reparse point of directory type
crosses mount point.

Signed-off-by: Pali Rohár 
Signed-off-by: Steve French