[PATCH] ksmbd: match the full EA name in single-entry queries

[PATCH] ksmbd: match the full EA name in single-entry queries

[DaeMyung Kang]

An SMB2 QUERY_INFO request can name a specific extended attribute with
FILE_GET_EA_INFORMATION. smb2_get_ea() compares only EaNameLength bytes
of each xattr name, so a request for "Foo" also matches "Foobar". If
both EAs exist and listxattr() returns "Foobar" first, ksmbd returns
"Foobar" and its value instead of "Foo". It also returns "Foobar" when
"Foo" does not exist.

Check the xattr name length after removing the user. prefix before
comparing the name bytes. This keeps enumeration without a requested
name unchanged.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
 fs/smb/server/smb2pdu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 12a43efdb53f..a49cc3a0c9de 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6738,8 +6738,9 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
 			continue;
 
 		if (req->InputBufferLength &&
-		    strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
-			    ea_req->EaNameLength))
+		    (name_len - XATTR_USER_PREFIX_LEN != ea_req->EaNameLength ||
+		     strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
+			     ea_req->EaNameLength)))
 			continue;
 
 		if (smb2_is_private_ea(&name[XATTR_USER_PREFIX_LEN],
-- 
2.43.0

Re: [PATCH] ksmbd: match the full EA name in single-entry queries

[CharSyam]

Please disregard this patch. I found that the same EA name length
check was already proposed by Ze Tan in [RFC PATCH v2 6/9] ksmbd:
support
security.capability EAs: https://lists.openwall.net/linux-kernel/2026/07/17/194

Sorry for the duplicate.

2026년 10월 11일 (일) 오후 3:00, DaeMyung Kang <charsyam@gmail.com>님이 작성:
>
> An SMB2 QUERY_INFO request can name a specific extended attribute with
> FILE_GET_EA_INFORMATION. smb2_get_ea() compares only EaNameLength bytes
> of each xattr name, so a request for "Foo" also matches "Foobar". If
> both EAs exist and listxattr() returns "Foobar" first, ksmbd returns
> "Foobar" and its value instead of "Foo". It also returns "Foobar" when
> "Foo" does not exist.
>
> Check the xattr name length after removing the user. prefix before
> comparing the name bytes. This keeps enumeration without a requested
> name unchanged.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@vger.kernel.org
> Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
> ---
>  fs/smb/server/smb2pdu.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
> index 12a43efdb53f..a49cc3a0c9de 100644
> --- a/fs/smb/server/smb2pdu.c
> +++ b/fs/smb/server/smb2pdu.c
> @@ -6738,8 +6738,9 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
>                         continue;
>
>                 if (req->InputBufferLength &&
> -                   strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
> -                           ea_req->EaNameLength))
> +                   (name_len - XATTR_USER_PREFIX_LEN != ea_req->EaNameLength ||
> +                    strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
> +                            ea_req->EaNameLength)))
>                         continue;
>
>                 if (smb2_is_private_ea(&name[XATTR_USER_PREFIX_LEN],
> --
> 2.43.0
>