[BUG] ksmbd: OOB read in share_config_request() when payload_sz == 0

[BUG] ksmbd: OOB read in share_config_request() when payload_sz == 0

[Farhad Alemi]

Hello Namjae and Steve,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/106-ksmbd-oob-read-share_config_request/

  BUG: KASAN: slab-out-of-bounds in strnlen+0x66/0x90 lib/string.c:432
  kstrndup+0x2d/0x160 mm/util.c:120
  share_config_request fs/smb/server/mgmt/share_config.c:168 [inline]
  ksmbd_share_config_get+0x5e0/0x1190
       fs/smb/server/mgmt/share_config.c:243
  smb2_tree_connect+0x2f4/0x1320 fs/smb/server/smb2pdu.c:2015

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] ksmbd: OOB read in share_config_request() when payload_sz == 0

[Namjae Jeon]

[-- Attachment #1: Type: text/plain, Size: 880 bytes --]

On Fri, Aug 28, 2026 at 7:38 AM Farhad Alemi <farhad.alemi@berkeley.edu> wrote:
>
> Hello Namjae and Steve,
>
> While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> SEFCOM lab, we hit the crash below. Crash reports can be found here:
>
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/106-ksmbd-oob-read-share_config_request/
>
>   BUG: KASAN: slab-out-of-bounds in strnlen+0x66/0x90 lib/string.c:432
>   kstrndup+0x2d/0x160 mm/util.c:120
>   share_config_request fs/smb/server/mgmt/share_config.c:168 [inline]
>   ksmbd_share_config_get+0x5e0/0x1190
>        fs/smb/server/mgmt/share_config.c:243
>   smb2_tree_connect+0x2f4/0x1320 fs/smb/server/smb2pdu.c:2015
>
> Our reproducer.c is available upon request.
>
> Happy to test a patch if that would help.
Can you test if the attached patch fixes this issue?

Thanks.

[-- Attachment #2: 0001-ksmbd-prevent-out-of-bounds-reads-in-share-config-re.patch --]
[-- Type: text/x-patch, Size: 4126 bytes --]

From d2c0970ab706b1d9e6c7960aeb17521acbc7b32c Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Fri, 28 Aug 2026 08:39:57 +0900
Subject: [PATCH 1/2] ksmbd: prevent out-of-bounds reads in share config
 responses

Validate IPC share configuration payload sizes before consuming
variable-length fields. Bound veto list parsing and account for
the separator byte when deriving the path length.

Fixes: a677ebd8ca2f ("ksmbd: validate payload size in ipc response")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/smb/server/mgmt/share_config.c | 40 +++++++++++++++++++++----------
 fs/smb/server/transport_ipc.c     | 21 ++++++++++------
 2 files changed, 41 insertions(+), 20 deletions(-)

diff --git a/fs/smb/server/mgmt/share_config.c b/fs/smb/server/mgmt/share_config.c
index b2d9580bddc6..cc9f18ede80d 100644
--- a/fs/smb/server/mgmt/share_config.c
+++ b/fs/smb/server/mgmt/share_config.c
@@ -146,9 +146,9 @@ static struct ksmbd_share_config *__share_lookup(const char *name)
 
 static int parse_veto_list(struct ksmbd_share_config *share,
 			   char *veto_list,
-			   int veto_list_sz)
+			   size_t veto_list_sz)
 {
-	int sz = 0;
+	size_t sz;
 
 	if (!veto_list_sz)
 		return 0;
@@ -156,7 +156,7 @@ static int parse_veto_list(struct ksmbd_share_config *share,
 	while (veto_list_sz > 0) {
 		struct ksmbd_veto_pattern *p;
 
-		sz = strlen(veto_list);
+		sz = strnlen(veto_list, veto_list_sz);
 		if (!sz)
 			break;
 
@@ -164,7 +164,7 @@ static int parse_veto_list(struct ksmbd_share_config *share,
 		if (!p)
 			return -ENOMEM;
 
-		p->pattern = kstrdup(veto_list, KSMBD_DEFAULT_GFP);
+		p->pattern = kstrndup(veto_list, sz, KSMBD_DEFAULT_GFP);
 		if (!p->pattern) {
 			kfree(p);
 			return -ENOMEM;
@@ -172,6 +172,9 @@ static int parse_veto_list(struct ksmbd_share_config *share,
 
 		list_add(&p->list, &share->veto_list);
 
+		if (sz == veto_list_sz)
+			break;
+
 		veto_list += sz + 1;
 		veto_list_sz -= (sz + 1);
 	}
@@ -224,17 +227,28 @@ static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work,
 	}
 
 	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
-		int path_len = PATH_MAX;
-
-		if (resp->payload_sz)
-			path_len = resp->payload_sz - resp->veto_list_sz;
+		size_t path_len;
 
-		share->path = kstrndup(ksmbd_share_config_path(resp), path_len,
-				      KSMBD_DEFAULT_GFP);
-		if (!share->path) {
-			ret = -ENOMEM;
+		if (resp->payload_sz <= resp->veto_list_sz) {
+			ret = -EINVAL;
 		} else {
-			ret = 0;
+			path_len = resp->payload_sz - resp->veto_list_sz;
+			if (resp->veto_list_sz)
+				path_len--;
+
+			if (!path_len) {
+				ret = -EINVAL;
+			} else {
+				share->path = kstrndup(
+					ksmbd_share_config_path(resp),
+					path_len, KSMBD_DEFAULT_GFP);
+				if (!share->path)
+					ret = -ENOMEM;
+				else
+					ret = 0;
+			}
+		}
+		if (share->path) {
 			share->path_sz = strlen(share->path);
 			while (share->path_sz > 1 &&
 			       share->path[share->path_sz - 1] == '/')
diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
index 4b0b572a3e1b..e550aa41ad2c 100644
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -532,14 +532,21 @@ static int ipc_validate_msg(struct ipc_msg_table_entry *entry)
 		if (entry->msg_sz < sizeof(struct ksmbd_share_config_response))
 			return -EINVAL;
 
-		if (resp->payload_sz) {
-			if (resp->payload_sz < resp->veto_list_sz)
-				return -EINVAL;
+		if (strnlen(resp->share_name, sizeof(resp->share_name)) ==
+		    sizeof(resp->share_name))
+			return -EINVAL;
 
-			if (check_add_overflow(sizeof(struct ksmbd_share_config_response),
-					       resp->payload_sz, &msg_sz))
-				return -EINVAL;
-		}
+		if (resp->veto_list_sz > resp->payload_sz)
+			return -EINVAL;
+
+		if (resp->flags != KSMBD_SHARE_FLAG_INVALID &&
+		    !(resp->flags & KSMBD_SHARE_FLAG_PIPE) &&
+		    resp->payload_sz <= resp->veto_list_sz)
+			return -EINVAL;
+
+		if (check_add_overflow(sizeof(struct ksmbd_share_config_response),
+				       resp->payload_sz, &msg_sz))
+			return -EINVAL;
 		break;
 	}
 	case KSMBD_EVENT_LOGIN_REQUEST_EXT:
-- 
2.34.1

Re: [BUG] ksmbd: OOB read in share_config_request() when payload_sz == 0

[Farhad Alemi]

On Thu, Aug 27, 2026 at 7:36 PM Namjae Jeon <linkinjeon@kernel.org> wrote:
>
> On Fri, Aug 28, 2026 at 7:38 AM Farhad Alemi <farhad.alemi@berkeley.edu> wrote:
> >
> > Hello Namjae and Steve,
> >
> > While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> > SEFCOM lab, we hit the crash below. Crash reports can be found here:
> >
> >   https://github.com/farhad-alemi/public_bug_reports/tree/main/106-ksmbd-oob-read-share_config_request/
> >
> >   BUG: KASAN: slab-out-of-bounds in strnlen+0x66/0x90 lib/string.c:432
> >   kstrndup+0x2d/0x160 mm/util.c:120
> >   share_config_request fs/smb/server/mgmt/share_config.c:168 [inline]
> >   ksmbd_share_config_get+0x5e0/0x1190
> >        fs/smb/server/mgmt/share_config.c:243
> >   smb2_tree_connect+0x2f4/0x1320 fs/smb/server/smb2pdu.c:2015
> >
> > Our reproducer.c is available upon request.
> >
> > Happy to test a patch if that would help.
> Can you test if the attached patch fixes this issue?
>
> Thanks.

Tested on 388b607d107c07aaade04c7f22f344cab6bdccd3 built w
UpstreamAppArmorKASAN.config; patched version no longer panics.
Thanks!

[PATCH] ksmbd: accept share config responses from ksmbd-tools before 3.5.3

[Michail Andreas Michalopoulos]

ksmbd-tools releases before 3.5.2 do not have the payload_sz field in
struct ksmbd_share_config_response; the field occupies the last word of
their reserved[] area, so the kernel always sees payload_sz == 0 from
them.  ipc_validate_msg() and share_config_request() used to treat
payload_sz == 0 as "legacy userspace" and skip the payload size checks.

That case was removed by
commit f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config responses").
With payload_sz == 0:

 - the IPC$ (pipe) response fails the final message size comparison:
   these tools always send a one-byte payload, so msg_sz is
   sizeof(*resp) + 1, but the expected size is now computed as
   sizeof(*resp) + 0;
 - every other share fails "payload_sz <= veto_list_sz".

In addition, ksmbd-tools before 3.5.3 copy a global "veto files" setting
into the IPC$ response, so with such a configuration IPC$ also fails the
now unconditional "veto_list_sz > payload_sz" check, even though pipe
shares never use a veto list.

ksmbd_ipc_share_config_request() then returns NULL and every tree
connect fails with STATUS_BAD_NETWORK_NAME, so ksmbd cannot serve any
share when used with these ksmbd-tools releases, for example the 3.5.1
package shipped by Ubuntu 24.04.  Login still works, which makes the
failure look like a configuration problem:

  CIFS: VFS: BAD_NETWORK_NAME: \\127.0.0.1\IPC$
  CIFS: VFS: \\127.0.0.1 failed to connect to IPC (rc=-2)

When payload_sz is zero, derive it from the size of the message actually
received and store it back in the response, so that the checks in
ipc_validate_msg() and the path and veto list parsing in
share_config_request() all use the same bound.  The response is the
kernel's own copy made by handle_response(), and msg_sz has already been
checked to be at least sizeof(*resp), so this cannot underflow.  All
checks added by that commit then apply unchanged, bounded by the bytes
that really arrived, and newer ksmbd-tools that fill in payload_sz are
unaffected.  Also skip the veto list size check for pipe shares:
share_config_request() reads neither the path nor the veto list for
them.

Tested in QEMU with ksmbd-tools 3.5.1 and 3.5.7 and the in-kernel SMB
client over loopback, with and without a global "veto files" setting.

Fixes: f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config responses")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
---
Found with AI assistance.

f25e93768fcc was also backported to 5.15.222, 6.1.189, 6.6.158,
6.12.111, 6.18.53 and 7.2.6, so those stable lines are affected too;
this patch applies to all of them (5.15 with the older fs/ksmbd/
paths) and to ksmbd-for-next.

It keeps that commit's OOB fix: the payload size is taken from the bytes
actually received, so a short response like the one in Farhad's report
is still rejected.

Tested in QEMU (KASAN) on 7.3 and on ksmbd-for-next (1db57ad99d46) with
the in-kernel SMB client over loopback, using ksmbd-tools 3.5.1 and
3.5.7, with and without "veto files" in [global]. Unpatched, 3.5.1
fails to connect to every share; patched, all combinations mount, IPC$
connects, reads/writes work and veto files are still enforced.

 fs/smb/server/transport_ipc.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
index e550aa41ad..f5cfc32050 100644
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -532,11 +532,25 @@ static int ipc_validate_msg(struct ipc_msg_table_entry *entry)
 		if (entry->msg_sz < sizeof(struct ksmbd_share_config_response))
 			return -EINVAL;
 
+		/*
+		 * ksmbd-tools releases before 3.5.2 leave payload_sz zero.
+		 * Derive it from the size of the message actually received so
+		 * the checks below bound the payload for those releases too.
+		 */
+		if (!resp->payload_sz)
+			resp->payload_sz = entry->msg_sz -
+				sizeof(struct ksmbd_share_config_response);
+
 		if (strnlen(resp->share_name, sizeof(resp->share_name)) ==
 		    sizeof(resp->share_name))
 			return -EINVAL;
 
-		if (resp->veto_list_sz > resp->payload_sz)
+		/*
+		 * Pipe shares carry no veto list, but ksmbd-tools before 3.5.3
+		 * copy a global "veto files" setting into the IPC$ response.
+		 */
+		if (!(resp->flags & KSMBD_SHARE_FLAG_PIPE) &&
+		    resp->veto_list_sz > resp->payload_sz)
 			return -EINVAL;
 
 		if (resp->flags != KSMBD_SHARE_FLAG_INVALID &&
-- 
2.43.0

Re: [PATCH] ksmbd: accept share config responses from ksmbd-tools before 3.5.3

[Namjae Jeon]

On Tue, Oct 20, 2026 at 4:11 AM Michail Andreas Michalopoulos
<mike.michalo@gmail.com> wrote:
>
> ksmbd-tools releases before 3.5.2 do not have the payload_sz field in
> struct ksmbd_share_config_response; the field occupies the last word of
> their reserved[] area, so the kernel always sees payload_sz == 0 from
> them.  ipc_validate_msg() and share_config_request() used to treat
> payload_sz == 0 as "legacy userspace" and skip the payload size checks.
>
> That case was removed by
> commit f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config responses").
> With payload_sz == 0:
>
>  - the IPC$ (pipe) response fails the final message size comparison:
>    these tools always send a one-byte payload, so msg_sz is
>    sizeof(*resp) + 1, but the expected size is now computed as
>    sizeof(*resp) + 0;
>  - every other share fails "payload_sz <= veto_list_sz".
>
> In addition, ksmbd-tools before 3.5.3 copy a global "veto files" setting
> into the IPC$ response, so with such a configuration IPC$ also fails the
> now unconditional "veto_list_sz > payload_sz" check, even though pipe
> shares never use a veto list.
>
> ksmbd_ipc_share_config_request() then returns NULL and every tree
> connect fails with STATUS_BAD_NETWORK_NAME, so ksmbd cannot serve any
> share when used with these ksmbd-tools releases, for example the 3.5.1
> package shipped by Ubuntu 24.04.  Login still works, which makes the
> failure look like a configuration problem:
>
>   CIFS: VFS: BAD_NETWORK_NAME: \\127.0.0.1\IPC$
>   CIFS: VFS: \\127.0.0.1 failed to connect to IPC (rc=-2)
>
> When payload_sz is zero, derive it from the size of the message actually
> received and store it back in the response, so that the checks in
> ipc_validate_msg() and the path and veto list parsing in
> share_config_request() all use the same bound.  The response is the
> kernel's own copy made by handle_response(), and msg_sz has already been
> checked to be at least sizeof(*resp), so this cannot underflow.  All
> checks added by that commit then apply unchanged, bounded by the bytes
> that really arrived, and newer ksmbd-tools that fill in payload_sz are
> unaffected.  Also skip the veto list size check for pipe shares:
> share_config_request() reads neither the path nor the veto list for
> them.
>
> Tested in QEMU with ksmbd-tools 3.5.1 and 3.5.7 and the in-kernel SMB
> client over loopback, with and without a global "veto files" setting.
>
> Fixes: f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config responses")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Applied it to #ksmbd-for-next.
Thanks!