Re: [PATCH] ksmbd: do not read past the DACL in the access denied debug message

[Namjae Jeon]

On Mon, Nov 2, 2026 at 2:10 PM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> When smb_check_perm_dacl() falls back to the POSIX ACL and then denies
> the request, its debug message prints the access mask of the ACE that
> the second DACL walk stopped at. On that path the walk ran to the end
> of the DACL, so the pointer is one past the last ACE. If the DACL is
> the last part of the stored security descriptor, the message reads 4
> bytes past the buffer, and KASAN reports a slab-out-of-bounds read in
> smb_check_perm_dacl().
>
> Print the requested and allowed masks instead. They are what the check
> compares.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!