Re: [PATCH] ksmbd: validate COPYCHUNK source and target ranges

[Namjae Jeon]

On Tue, Sep 1, 2026 at 9:05 AM Alon Shakevsky via B4 Relay
<devnull+shakevsky.berkeley.edu@xxxxxxxxxx> wrote:
>
> From: Alon Shakevsky <shakevsky@xxxxxxxxxxxx>
>
> ksmbd_vfs_copy_file_ranges() rejects negative source offsets in the
> copy loop, but it does not validate target offsets. It also calculates
> lock and overlap endpoints before ensuring that either range fits within
> MAX_LFS_FILESIZE.
>
> When the target is an alternate data stream, the buffered path passes a
> negative target offset to ksmbd_vfs_stream_write(). Let n be Length and
> let -d be TargetOffset, where 0 < d < n <= XATTR_SIZE_MAX. For an empty
> stream, the writer allocates n - d bytes, then copies n bytes starting d
> bytes before the allocation. An authenticated SMB client can control d
> and the source data, overwrite kernel heap memory, and crash the host.
>
> Validate both ranges before lock, overlap, or I/O calculations.
>
> Fixes: 8482150a0743 ("ksmbd: support copychunk for alternate data streams")
> Assisted-by: Antiproof:GPT-5.6-Sol
> Signed-off-by: Alon Shakevsky <shakevsky@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!