[PATCH] ksmbd: do not read past the DACL in the access denied debug message

[PATCH] ksmbd: do not read past the DACL in the access denied debug message

[Ian Bridges]

When smb_check_perm_dacl() falls back to the POSIX ACL and then denies
the request, its debug message prints the access mask of the ACE that
the second DACL walk stopped at. On that path the walk ran to the end
of the DACL, so the pointer is one past the last ACE. If the DACL is
the last part of the stored security descriptor, the message reads 4
bytes past the buffer, and KASAN reports a slab-out-of-bounds read in
smb_check_perm_dacl().

Print the requested and allowed masks instead. They are what the check
compares.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
---

Notes:
    ksmbd_debug() evaluates its arguments only when SMB debug output is on
    (/sys/class/ksmbd-control/debug). The 4 bytes go to the kernel log.
    
    Tested on ksmbd-for-next d13da43938d1 with KASAN. With SMB debug
    enabled, a WRITE_DATA request reaches the POSIX ACL fallback and is
    denied. Before the fix, the denial triggers a KASAN report. After the
    fix, the request remains denied and KASAN reports no error. No other
    access result changes. smbtorture gives the same results as on the base.
    
    A reproducer is available on request.
    
    This fix was developed with LLM assistance.

 fs/smb/server/smbacl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 664f01263611..cdb04d29ed09 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1672,8 +1672,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
 	}
 
 	if (granted & ~access_bits) {
-		ksmbd_debug(SMB, "Access denied with winACL, granted : %x, access_req : %x\n",
-			    granted, le32_to_cpu(ace->access_req));
+		ksmbd_debug(SMB, "Access denied with winACL, requested : %x, allowed : %x\n",
+			    granted, access_bits);
 		rc = -EACCES;
 		goto err_out;
 	}

base-commit: d13da43938d15b0b719827d8f2b32df8eaec5def
-- 
2.47.3

Re: [PATCH] ksmbd: do not read past the DACL in the access denied debug message

[Namjae Jeon]

On Mon, Nov 2, 2026 at 2:10 PM Ian Bridges <icb@fastmail.org> wrote:
>
> When smb_check_perm_dacl() falls back to the POSIX ACL and then denies
> the request, its debug message prints the access mask of the ACE that
> the second DACL walk stopped at. On that path the walk ran to the end
> of the DACL, so the pointer is one past the last ACE. If the DACL is
> the last part of the stored security descriptor, the message reads 4
> bytes past the buffer, and KASAN reports a slab-out-of-bounds read in
> smb_check_perm_dacl().
>
> Print the requested and allowed masks instead. They are what the check
> compares.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ian Bridges <icb@fastmail.org>
Applied it to #ksmbd-for-next.
Thanks!