Re: [PATCH] ksmbd: use copied ACE count when walking DACL in set_ntacl_dacl

[Xiang Mei]

On Wed, Jul 22, 2026 at 5:19 PM Namjae Jeon <linkinjeon@xxxxxxxxxx> wrote:
>
> On Thu, Jul 23, 2026 at 8:59 AM Xiang Mei (Microsoft) <xmei5@xxxxxxx> wrote:
> >
> > set_ntacl_dacl() copies ACEs from the stored, attacker-controlled DACL
> > into pndace but may copy fewer than nt_num_aces (it skips ACEs with a bad
> > sid.num_subauth and breaks on size overflow). It still passes the raw
> > nt_num_aces to set_posix_acl_entries_dacl(), whose dedup loop then walks
> > that many ACEs and, past the last one actually copied, reads
> > sub_auth[num_subauth - 1] from uninitialized buffer memory - an
> > out-of-bounds read whose offset comes from that stale byte.
> >
> > Pass num_aces, the count actually copied, instead. For well-formed DACLs
> > num_aces equals nt_num_aces, so behavior is unchanged.
> >
> >   UBSAN: array-index-out-of-bounds in fs/smb/server/smbacl.c:651:27
> >   index -1 is out of range for type '__le32 [15]'
> >   Workqueue: ksmbd-io handle_ksmbd_work
> >   Call Trace:
> >    __ubsan_handle_out_of_bounds (lib/ubsan.c:455)
> >    set_posix_acl_entries_dacl (fs/smb/server/smbacl.c:651)
> >    build_sec_desc (fs/smb/server/smbacl.c:776 fs/smb/server/smbacl.c:1078)
> >    smb2_query_info (fs/smb/server/smb2pdu.c:6269 fs/smb/server/smb2pdu.c:6339)
> >    handle_ksmbd_work (fs/smb/server/server.c:308)
> >    process_one_work (kernel/workqueue.c:3322)
> >    worker_thread (kernel/workqueue.c:3486)
> >    kthread (kernel/kthread.c:436)
> >
> > Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> > Reported-by: AutonomousCodeSecurity@xxxxxxxxxxxxx
> > Signed-off-by: Xiang Mei (Microsoft) <xmei5@xxxxxxx>
> Thanks for the patch.
> Could you please check whether this issue is still present in the
> current ksmbd-for-next-next tree?

Thanks for pointing me to ksmbd-for-next-next. I am sorry I didn't
find the correct branch to test on. I'll improve my workflow to avoid
this kind of duplication.

The bug is actually fixed by 065148205b48.
The patch is complete for this issue.

-Xiang