Re: [PATCH v2] ksmbd: require NUL-terminated EA names

[Namjae Jeon]

On Tue, Nov 3, 2026 at 11:45 AM Yifan Zhang <yfzhang23@xxxxxxxxxxxxxx> wrote:
>
> smb2_set_ea() verifies that the byte reserved for the declared EA-name
> terminator lies inside the request, but it does not verify that the byte is
> zero. With SMB debug logging enabled, the name is passed to %s and the
> diagnostic reads beyond the request allocation.
>
> KASAN reports:
>
>   BUG: KASAN: slab-out-of-bounds in string
>   Read of size 1
>   string
>   vsnprintf
>   _printk
>   smb2_set_ea
>   smb2_set_info
>
> Reject an EA entry whose declared terminator byte is nonzero. Return
> -EBADMSG for the malformed buffer, and map that error to
> STATUS_EA_LIST_INCONSISTENT for both SET_INFO and CREATE.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Yifan Zhang <yfzhang23@xxxxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!