set_ntacl_dacl() copies ACEs from the stored, attacker-controlled DACL
into pndace but may copy fewer than nt_num_aces (it skips ACEs with a bad
sid.num_subauth and breaks on size overflow). It still passes the raw
nt_num_aces to set_posix_acl_entries_dacl(), whose dedup loop then walks
that many ACEs and, past the last one actually copied, reads
sub_auth[num_subauth - 1] from uninitialized buffer memory - an
out-of-bounds read whose offset comes from that stale byte.

Pass num_aces, the count actually copied, instead. For well-formed DACLs
num_aces equals nt_num_aces, so behavior is unchanged.

  UBSAN: array-index-out-of-bounds in fs/smb/server/smbacl.c:651:27
  index -1 is out of range for type '__le32 [15]'
  Workqueue: ksmbd-io handle_ksmbd_work
  Call Trace:
   __ubsan_handle_out_of_bounds (lib/ubsan.c:455)
   set_posix_acl_entries_dacl (fs/smb/server/smbacl.c:651)
   build_sec_desc (fs/smb/server/smbacl.c:776 fs/smb/server/smbacl.c:1078)
   smb2_query_info (fs/smb/server/smb2pdu.c:6269 fs/smb/server/smb2pdu.c:6339)
   handle_ksmbd_work (fs/smb/server/server.c:308)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3486)
   kthread (kernel/kthread.c:436)

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 fs/smb/server/smbacl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 67b39b4d218c..957547157ef8 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -774,7 +774,7 @@ static void set_ntacl_dacl(struct mnt_idmap *idmap,
 	}
 
 	set_posix_acl_entries_dacl(idmap, pndace, fattr,
-				   &num_aces, &size, nt_num_aces);
+				   &num_aces, &size, num_aces);
 	pndacl->num_aces = cpu_to_le16(num_aces);
 	pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
 }
-- 
2.43.0

On Thu, Jul 23, 2026 at 8:59 AM Xiang Mei (Microsoft) <xmei5@asu.edu> wrote:
>
> set_ntacl_dacl() copies ACEs from the stored, attacker-controlled DACL
> into pndace but may copy fewer than nt_num_aces (it skips ACEs with a bad
> sid.num_subauth and breaks on size overflow). It still passes the raw
> nt_num_aces to set_posix_acl_entries_dacl(), whose dedup loop then walks
> that many ACEs and, past the last one actually copied, reads
> sub_auth[num_subauth - 1] from uninitialized buffer memory - an
> out-of-bounds read whose offset comes from that stale byte.
>
> Pass num_aces, the count actually copied, instead. For well-formed DACLs
> num_aces equals nt_num_aces, so behavior is unchanged.
>
>   UBSAN: array-index-out-of-bounds in fs/smb/server/smbacl.c:651:27
>   index -1 is out of range for type '__le32 [15]'
>   Workqueue: ksmbd-io handle_ksmbd_work
>   Call Trace:
>    __ubsan_handle_out_of_bounds (lib/ubsan.c:455)
>    set_posix_acl_entries_dacl (fs/smb/server/smbacl.c:651)
>    build_sec_desc (fs/smb/server/smbacl.c:776 fs/smb/server/smbacl.c:1078)
>    smb2_query_info (fs/smb/server/smb2pdu.c:6269 fs/smb/server/smb2pdu.c:6339)
>    handle_ksmbd_work (fs/smb/server/server.c:308)
>    process_one_work (kernel/workqueue.c:3322)
>    worker_thread (kernel/workqueue.c:3486)
>    kthread (kernel/kthread.c:436)
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Thanks for the patch.
Could you please check whether this issue is still present in the
current ksmbd-for-next-next tree?

Could you share the steps to reproduce it?

On 7/23/26 08:19, Namjae Jeon wrote:
> Thanks for the patch.
> Could you please check whether this issue is still present in the
> current ksmbd-for-next-next tree?

-- 
ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en