Re: [PATCH v2] ksmbd: require NUL-terminated EA names

[ChenXiaoSong <chenxiaosong@chenxiaosong.com>]

Since Namjae provided some suggestions on v1, it would be better to add:

Suggested-by: Namjae Jeon <linkinjeon@kernel.org>

On 11/3/26 10:45, Yifan Zhang wrote:
> smb2_set_ea() verifies that the byte reserved for the declared EA-name
> terminator lies inside the request, but it does not verify that the byte is
> zero. With SMB debug logging enabled, the name is passed to %s and the
> diagnostic reads beyond the request allocation.
> 
> KASAN reports:
> 
>    BUG: KASAN: slab-out-of-bounds in string
>    Read of size 1
>    string
>    vsnprintf
>    _printk
>    smb2_set_ea
>    smb2_set_info
> 
> Reject an EA entry whose declared terminator byte is nonzero. Return
> -EBADMSG for the malformed buffer, and map that error to
> STATUS_EA_LIST_INCONSISTENT for both SET_INFO and CREATE.
> 
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Yifan Zhang<yfzhang23@stu.pku.edu.cn>
> ---
> Changes in v2:
> - Return -EBADMSG for the malformed EA name terminator.
> - Map -EBADMSG to STATUS_EA_LIST_INCONSISTENT in SET_INFO and CREATE.

-- 
ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en