From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta1.migadu.com (out-153.mta1.migadu.com [95.215.58.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 516A8277CA5 for ; Mon, 17 Aug 2026 01:40:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.153 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786930827; cv=none; b=CtvW2IUEiBHUCVGkSJSh46gjFzXHfw1kNbGfoUx/AAYihX2i4BUTL1OwbI9tu97ylI5/tYViCm8L4Jmcc2jto/jnqSoLidljoJNdJZtFtBNLimTIuGYRdFBksvwc9JjPYdxR84CnLZTpLfLsQ0B4rnMC04O8unmdAdyBlFzyFAI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786930827; c=relaxed/simple; bh=ecSozL1HT7k3CfKWhmOPnjpxmtlBVYVVnL1xugcLScM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=uUZkoIbco2ws0juSVP7CjjrJfYeIC65VbMfyeHvD3Xhnkdp4tcMYIc1GE6PImy4vSZGKQ48lCx7ainfMamrFxKQ+2QNayHtoBUdi+OKyTI2bvRnzkEtZBtaSUqwh6uyFCQI3G4XJmDetnq2f1/hreBsRu6HFjGhxPPQiFk1tXKI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=chenxiaosong.com; spf=pass smtp.mailfrom=chenxiaosong.com; dkim=pass (2048-bit key) header.d=chenxiaosong.com header.i=@chenxiaosong.com header.b=J5BRF6SU; arc=none smtp.client-ip=95.215.58.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=chenxiaosong.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chenxiaosong.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=chenxiaosong.com header.i=@chenxiaosong.com header.b="J5BRF6SU" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=ecSozL1HT7k3CfKWhmOPnjpxmtlBVYVVnL1xugcLScM=; c=simple/simple; d=chenxiaosong.com; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786930821; v=1; x=1787535621; b=J5BRF6SUHeceHfItydnKkx0zqm1htplj7h3mY/+HbDxmaOgNRuxqYiwksgPwoj8DbceiVJfU hb1T3tozlx8g4mrxaYNYH1wIm0xBknuyzOeurFMtqhZXHDosnXRa1rYwlWvPchr2yg3Pk055lG/ n3IP86Wpv8iF1aRDhg0j9kYq5jOyPaHKyb9XsSGMqiAuwPkUSXTlpFPDhnpz2uCgubbXKCOmgxQ mxY3p4uM0HagQBCUaQuenNdLfCIcMkMGB9ohOArepsXmEpVBL4Ylz70R02Xc27aEEVi9JrUWmf4 Az5pdnnZLv2IiJCP6Eov5d98nsWyojzM6GiZGyGhl8U/w== X-Envelope-To: linux-kernel@vger.kernel.org Received: from [172.21.20.206] (116.128.244.171) by smtp.migadu.com with ESMTPS id 41c890f4da0038b6; Mon, 17 Aug 2026 01:40:11 +0000 X-Migadu-Flow: FLOW_OUT Message-ID: Date: Mon, 17 Aug 2026 09:40:04 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 1/2] ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size To: Hang Nan <2122295973@qq.com>, Namjae Jeon , Steve French Cc: linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org, ChenXiaoSong References: <8970140c-1de1-4989-b32c-ea485be00b79@chenxiaosong.com> <20260812103945.82495-1-2122295973@qq.com> Content-Language: en-US From: ChenXiaoSong In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Reviewed-by: ChenXiaoSong On 8/12/26 18:39, Hang Nan wrote: > smb_check_perm_dacl() validates that the DACL fits inside the NT > security descriptor, but then bounds its two ACE walks by the > remaining NTSD length (acl_size) rather than the DACL's declared > size (pdacl_size). > > When pdacl->size is smaller than the trailing NTSD buffer, bytes > after the declared DACL boundary - still inside the stored security > descriptor - are parsed as ACEs during access checks. A crafted > DACL can place an access-granting ACE beyond pdacl->size, and the > current code accepts it during SMB2_CREATE access validation, while > parse_dacl() and smb_inherit_dacl() stop at pdacl_size. > > Bound both ACE walks by pdacl_size to match the DACL boundary > semantics used elsewhere in the server. > > Validation (KUnit, UML, x86_64, KASAN; first KUnit tests for > fs/smb/server, see follow-up patch): > - ksmbd_dacl_walk_must_stop_at_declared_size (semantic harness): > with the current code the ACE placed after pdacl->size is > selected and access is granted; with the fix the same sample > is denied (EACCES). > - ksmbd_smb_check_perm_dacl_boundary (drives the real function): > passes with the fix; fails with the fix reverted (rc == 0). > - ksmbd-for-next-next (rebased, base e9d76059ff03), x86_64 > > Fixes: 8f0541186e9a ("ksmbd: fix heap-based overflow in set_ntacl_dacl()") > Signed-off-by: Hang Nan<2122295973@qq.com> -- ChenXiaoSong Chinese Homepage: https://chenxiaosong.com English Homepage: https://chenxiaosong.com/en