Re: [PATCH] ksmbd: match the full EA name in single-entry queries

[CharSyam]

Please disregard this patch. I found that the same EA name length
check was already proposed by Ze Tan in [RFC PATCH v2 6/9] ksmbd:
support
security.capability EAs: https://lists.openwall.net/linux-kernel/2026/07/17/194

Sorry for the duplicate.

2026년 10월 11일 (일) 오후 3:00, DaeMyung Kang <charsyam@xxxxxxxxx>님이 작성:
>
> An SMB2 QUERY_INFO request can name a specific extended attribute with
> FILE_GET_EA_INFORMATION. smb2_get_ea() compares only EaNameLength bytes
> of each xattr name, so a request for "Foo" also matches "Foobar". If
> both EAs exist and listxattr() returns "Foobar" first, ksmbd returns
> "Foobar" and its value instead of "Foo". It also returns "Foobar" when
> "Foo" does not exist.
>
> Check the xattr name length after removing the user. prefix before
> comparing the name bytes. This keeps enumeration without a requested
> name unchanged.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: DaeMyung Kang <charsyam@xxxxxxxxx>
> ---
>  fs/smb/server/smb2pdu.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
> index 12a43efdb53f..a49cc3a0c9de 100644
> --- a/fs/smb/server/smb2pdu.c
> +++ b/fs/smb/server/smb2pdu.c
> @@ -6738,8 +6738,9 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
>                         continue;
>
>                 if (req->InputBufferLength &&
> -                   strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
> -                           ea_req->EaNameLength))
> +                   (name_len - XATTR_USER_PREFIX_LEN != ea_req->EaNameLength ||
> +                    strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
> +                            ea_req->EaNameLength)))
>                         continue;
>
>                 if (smb2_is_private_ea(&name[XATTR_USER_PREFIX_LEN],
> --
> 2.43.0
>