[PATCH] ksmbd: match the full EA name in single-entry queries

[DaeMyung Kang]

An SMB2 QUERY_INFO request can name a specific extended attribute with
FILE_GET_EA_INFORMATION. smb2_get_ea() compares only EaNameLength bytes
of each xattr name, so a request for "Foo" also matches "Foobar". If
both EAs exist and listxattr() returns "Foobar" first, ksmbd returns
"Foobar" and its value instead of "Foo". It also returns "Foobar" when
"Foo" does not exist.

Check the xattr name length after removing the user. prefix before
comparing the name bytes. This keeps enumeration without a requested
name unchanged.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: DaeMyung Kang <charsyam@xxxxxxxxx>
---
 fs/smb/server/smb2pdu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 12a43efdb53f..a49cc3a0c9de 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6738,8 +6738,9 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
 			continue;
 
 		if (req->InputBufferLength &&
-		    strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
-			    ea_req->EaNameLength))
+		    (name_len - XATTR_USER_PREFIX_LEN != ea_req->EaNameLength ||
+		     strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
+			     ea_req->EaNameLength)))
 			continue;
 
 		if (smb2_is_private_ea(&name[XATTR_USER_PREFIX_LEN],
-- 
2.43.0