Re: [PATCH] ksmbd: fix empty DACL handling in smb_check_perm_dacl()

[Namjae Jeon]

On Mon, Sep 7, 2026 at 1:31 PM Aamir Ahmed <elb12345@xxxxxxxxxxxxx> wrote:
>
> smb_check_perm_dacl() does not properly enforce an empty (present,
> zero-ACE) DACL. Per MS-DTYP section 2.4.5, an empty DACL grants no
> access to anyone except the object owner's implicit READ_CONTROL and
> WRITE_DAC permissions.
>
> The current code has two problems:
>
> 1. Non-owners requesting only READ_CONTROL or WRITE_DAC are allowed
>    access because the code does not check caller identity before
>    granting these permissions.
>
> 2. When pdacl_size exceeds sizeof(struct smb_acl) (trailing bytes
>    after the zero-ACE DACL header), the condition
>    !(pdacl_size - sizeof(struct smb_acl)) evaluates to false, and the
>    function returns success (rc=0) regardless of the access requested.
>    This means trailing bytes after a zero-ACE DACL bypass all access
>    control.
>
> Fix both by moving the uid/sid resolution and is_owner determination
> before the num_aces check, then denying all non-owner access and
> restricting owners to READ_CONTROL|WRITE_DAC.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
This patch is same with "ksmbd: deny access for an empty DACL instead
of granting the request".
It seems like only the patch titles are different. Which one should I check?