[PATCH v2] ksmbd: require NUL-terminated EA names

[PATCH v2] ksmbd: require NUL-terminated EA names

[Yifan Zhang]

smb2_set_ea() verifies that the byte reserved for the declared EA-name
terminator lies inside the request, but it does not verify that the byte is
zero. With SMB debug logging enabled, the name is passed to %s and the
diagnostic reads beyond the request allocation.

KASAN reports:

  BUG: KASAN: slab-out-of-bounds in string
  Read of size 1
  string
  vsnprintf
  _printk
  smb2_set_ea
  smb2_set_info

Reject an EA entry whose declared terminator byte is nonzero. Return
-EBADMSG for the malformed buffer, and map that error to
STATUS_EA_LIST_INCONSISTENT for both SET_INFO and CREATE.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
---
Changes in v2:
- Return -EBADMSG for the malformed EA name terminator.
- Map -EBADMSG to STATUS_EA_LIST_INCONSISTENT in SET_INFO and CREATE.

 fs/smb/server/smb2pdu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index be226664b8afc..c0be3265246dd 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3454,6 +3454,11 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len,
 		if (!eabuf->EaNameLength)
 			goto next;
 
+		if (eabuf->name[eabuf->EaNameLength]) {
+			rc = -EBADMSG;
+			break;
+		}
+
 		ksmbd_debug(SMB,
 			    "name : <%s>, name_len : %u, value_len : %u, next : %u\n",
 			    eabuf->name, eabuf->EaNameLength,
@@ -5606,6 +5611,8 @@ int smb2_open(struct ksmbd_work *work)
 	if (rc) {
 		if (rc == -EINVAL)
 			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		else if (rc == -EBADMSG)
+			rsp->hdr.Status = STATUS_EA_LIST_INCONSISTENT;
 		else if (rc == -EOPNOTSUPP)
 			rsp->hdr.Status = STATUS_NOT_SUPPORTED;
 		else if ((rc == -EACCES || rc == -ESTALE || rc == -EXDEV) &&
@@ -9304,6 +9311,8 @@ int smb2_set_info(struct ksmbd_work *work)
 	}
 	else if (rc == -EINVAL)
 		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+	else if (rc == -EBADMSG)
+		rsp->hdr.Status = STATUS_EA_LIST_INCONSISTENT;
 	else if (rc == -EMSGSIZE)
 		rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH;
 	else if (rc == -ENOSPC || rc == -EFBIG)
-- 
2.39.5 (Apple Git-154)

Re: [PATCH v2] ksmbd: require NUL-terminated EA names

[ChenXiaoSong]

Since Namjae provided some suggestions on v1, it would be better to add:

Suggested-by: Namjae Jeon <linkinjeon@kernel.org>

On 11/3/26 10:45, Yifan Zhang wrote:
> smb2_set_ea() verifies that the byte reserved for the declared EA-name
> terminator lies inside the request, but it does not verify that the byte is
> zero. With SMB debug logging enabled, the name is passed to %s and the
> diagnostic reads beyond the request allocation.
> 
> KASAN reports:
> 
>    BUG: KASAN: slab-out-of-bounds in string
>    Read of size 1
>    string
>    vsnprintf
>    _printk
>    smb2_set_ea
>    smb2_set_info
> 
> Reject an EA entry whose declared terminator byte is nonzero. Return
> -EBADMSG for the malformed buffer, and map that error to
> STATUS_EA_LIST_INCONSISTENT for both SET_INFO and CREATE.
> 
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Yifan Zhang<yfzhang23@stu.pku.edu.cn>
> ---
> Changes in v2:
> - Return -EBADMSG for the malformed EA name terminator.
> - Map -EBADMSG to STATUS_EA_LIST_INCONSISTENT in SET_INFO and CREATE.

-- 
ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en

Re: [PATCH v2] ksmbd: require NUL-terminated EA names

[Yifan Zhang]

Thanks. I will add:

Suggested-by: Namjae Jeon <linkinjeon@kernel.org>

in the next revision.

Regards,
Yifan

Re: [PATCH v2] ksmbd: require NUL-terminated EA names

[ChenXiaoSong]

No need to send v3. v2 looks lood. When Namjae applies the patch using b4, this tag will be included automatically.


On November 3, 2026 11:19:54 AM GMT+08:00, Yifan Zhang <yfzhang23@stu.pku.edu.cn> wrote:
>Thanks. I will add:
>
>Suggested-by: Namjae Jeon <linkinjeon@kernel.org>
>
>in the next revision.
>
>Regards,
>Yifan

ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en

Re: [PATCH v2] ksmbd: require NUL-terminated EA names

[Namjae Jeon]

On Tue, Nov 3, 2026 at 11:45 AM Yifan Zhang <yfzhang23@stu.pku.edu.cn> wrote:
>
> smb2_set_ea() verifies that the byte reserved for the declared EA-name
> terminator lies inside the request, but it does not verify that the byte is
> zero. With SMB debug logging enabled, the name is passed to %s and the
> diagnostic reads beyond the request allocation.
>
> KASAN reports:
>
>   BUG: KASAN: slab-out-of-bounds in string
>   Read of size 1
>   string
>   vsnprintf
>   _printk
>   smb2_set_ea
>   smb2_set_info
>
> Reject an EA entry whose declared terminator byte is nonzero. Return
> -EBADMSG for the malformed buffer, and map that error to
> STATUS_EA_LIST_INCONSISTENT for both SET_INFO and CREATE.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
Applied it to #ksmbd-for-next.
Thanks!