[PATCH v2 0/2] ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

[Hang Nan]

Hi ChenXiaoSong,

Thanks for the review. All three points are addressed:

1. The patch is rebased onto the current ksmbd-for-next-next
   (base e9d76059ff03 "smb: server: Clear sensitive stack and heap
   data in auth.c", 2026-08-11).  Rebased v2: patch 1/2.

2. The semantic KUnit harness is now the first KUnit test for
   fs/smb/server (patch 2/2), as you suggested.  It contains two
   tests in fs/smb/server/smbacl_kunit_test.c:

   - ksmbd_dacl_walk_must_stop_at_declared_size: the pure semantic
     harness used for the validation quoted in your mail.  It models
     the ACE walk and pins the invariant that the walk stops at
     struct smb_acl::size -- the post-boundary ACE is selected with
     the old (enclosing descriptor length) boundary and rejected with
     the declared-size boundary.

   - ksmbd_smb_check_perm_dacl_boundary: drives the real
     smb_check_perm_dacl() with a crafted descriptor stored through
     ksmbd's own NTACL xattr path on a tmpfs file, and asserts the
     post-boundary ACE is denied with -EACCES.  With the fix reverted
     this test fails (rc == 0, access granted), so it guards the
     boundary fix itself rather than only a model of it.

3. Validation (KUnit, UML, x86_64, KASAN, CONFIG_SMB_SERVER_KUNIT_TEST=y):

   with the fix:    ksmbd-smbacl: pass 2, fail 0
   fix reverted:    ksmbd_smb_check_perm_dacl_boundary_test FAILS
                    (expected -EACCES, got rc == 0)

Happy to split the harness into a separate RFC or adjust anything
else.

Thanks,
Hang

--
Hang Nan <2122295973@xxxxxx>