[PATCH v2 0/3] ksmbd: fix information leaks in smb2_get_info_filesystem()

[Aleksandr Khromov]

smb2_get_info_filesystem() sets rsp->OutputBufferLength to the full size
of the structure of the requested info level, but three levels leave
part of that structure unwritten:

  FS_OBJECT_ID_INFORMATION  31 of 64 bytes (objid[] tail when the volume
                            UUID is unavailable, plus version_string[])
  FS_CONTROL_INFORMATION     4 of 48 bytes (FileSystemControlFlags)
  FS_POSIX_INFORMATION       8 of 56 bytes (FileSysIdentifier)

The response buffer is zeroed on allocation, so a standalone request
returns zeros there.  A compound request need not:
work->next_smb2_rsp_hdr_off is advanced by the length pinned for the
previous response, so if a command wrote its reply into the buffer and
then failed, smb2_set_err_rsp() pins only the short error response and
the next reply is laid over the bytes already written.  Only the header
is cleared at that point:

	memset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);

What leaks is not arbitrary kernel memory but a reply that ksmbd built
for the same connection and did not send, including one that failed with
an access denied error.

Compile tested only (x86_64_defconfig + CONFIG_SMB_SERVER=m).

v2: v1 was a single patch clearing only objid[].  ChenXiaoSong asked in
    review whether extended_info.version_string leaks as well; it does,
    and so do the other two levels, so v2 clears the whole structure in
    patch 1 and adds patches 2 and 3.  All three go back to the original
    ksmbd import rather than to commit 3a64125730ca ("ksmbd: use volume
    UUID in FS_OBJECT_ID_INFORMATION"), so the Fixes: tags moved
    accordingly; on trees without that commit patch 1 needs a trivial
    context fixup.
    v1: https://lore.kernel.org/linux-cifs/20260821135801.3790290-1-haa@xxxxxxxxx/

Aleksandr Khromov (3):
  ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
  ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
  ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION

 fs/smb/server/smb2pdu.c | 4 ++++
 1 file changed, 4 insertions(+)

-- 
2.48.1