From: Tristan Madani <tristmd@gmail.com>
To: Namjae Jeon <linkinjeon@kernel.org>, Steve French <smfrench@gmail.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>,
Tom Talpey <tom@talpey.com>,
linux-cifs@vger.kernel.org, stable@vger.kernel.org,
Tristan Madani <tristan@talencesecurity.com>
Subject: [PATCH] ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
Date: Fri, 17 Apr 2026 19:20:36 +0000 [thread overview]
Message-ID: <20260417192036.268452-1-tristan@talencesecurity.com> (raw)
smb2_get_ea() applies 4-byte alignment padding via memset() after
writing each EA entry. The bounds check for buf_free_len is performed
before the value memcpy, but the alignment memset fires unconditionally
afterward with no check. When the EA value exactly fills the remaining
buffer space (buf_free_len == 0 after value subtraction), the alignment
memset writes 1-3 NUL bytes past the buf_free_len boundary.
Add a bounds check before the alignment memset to prevent writing past
the authorized buffer space.
This is the same bug pattern as commit beef2634f81f ("ksmbd: fix
out-of-bounds write in get_file_all_info() for compound requests")
and commit fda9522ed6af ("ksmbd: fix out-of-bounds write in
ksmbd_vfs_get_sd_xattr() for compound requests"), both of which
added bounds checks before unconditional writes in QUERY_INFO
response formatting.
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/smb/server/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index ee32e61b6d3c7..407173d2175af 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4821,6 +4821,8 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
/* align next xattr entry at 4 byte bundary */
alignment_bytes = ((next_offset + 3) & ~3) - next_offset;
if (alignment_bytes) {
+ if (buf_free_len < alignment_bytes)
+ break;
memset(ptr, '\0', alignment_bytes);
ptr += alignment_bytes;
next_offset += alignment_bytes;
--
2.47.3
next reply other threads:[~2026-04-17 19:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-17 19:20 Tristan Madani [this message]
2026-04-17 19:33 ` [PATCH v2] ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Tristan Madani
2026-04-18 6:27 ` Namjae Jeon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260417192036.268452-1-tristan@talencesecurity.com \
--to=tristmd@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=senozhatsky@chromium.org \
--cc=smfrench@gmail.com \
--cc=stable@vger.kernel.org \
--cc=tom@talpey.com \
--cc=tristan@talencesecurity.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).