Re: [PATCH v2] ksmbd: require NUL-terminated EA names

[ChenXiaoSong]

Since Namjae provided some suggestions on v1, it would be better to add:

Suggested-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>

On 11/3/26 10:45, Yifan Zhang wrote:
> smb2_set_ea() verifies that the byte reserved for the declared EA-name
> terminator lies inside the request, but it does not verify that the byte is
> zero. With SMB debug logging enabled, the name is passed to %s and the
> diagnostic reads beyond the request allocation.
>
> KASAN reports:
>
>    BUG: KASAN: slab-out-of-bounds in string
>    Read of size 1
>    string
>    vsnprintf
>    _printk
>    smb2_set_ea
>    smb2_set_info
>
> Reject an EA entry whose declared terminator byte is nonzero. Return
> -EBADMSG for the malformed buffer, and map that error to
> STATUS_EA_LIST_INCONSISTENT for both SET_INFO and CREATE.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Yifan Zhang<yfzhang23@xxxxxxxxxxxxxx>
> ---
> Changes in v2:
> - Return -EBADMSG for the malformed EA name terminator.
> - Map -EBADMSG to STATUS_EA_LIST_INCONSISTENT in SET_INFO and CREATE.

--
ChenXiaoSong <chenxiaosong@xxxxxxxxxxxxxxxx>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en