From nobody Mon Sep 28 08:46:16 2026 Received: from mail.amicon.ru (unknown [77.108.111.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 60108375F82; Mon, 24 Aug 2026 10:23:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=77.108.111.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787566995; cv=none; b=k5CsqkC5lj57Y1HG0rPTW7QCKI7mpWNDNeeVI7w7072zO9mRDhnosa0hH2GPXHxgsvDQ+XEOBZ9Y3POT43BSeQnkr8R8tJ323V371E+YcQqkitX7YAYYRtxHYomIsNtL+s0ab6ncfR34ihKFFi1CkuqQWjRmMlZXLLig2pvgSRA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787566995; c=relaxed/simple; bh=IcMqAquUYIjmqqC5ZhMeop2YaOzLFYBW8X3+dvdhgKs=; h=Content-Type:From:To:CC:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version; b=npeuAwjM21uv5xNw9S11DN6A1adhZyznM5zvhcqLdVka/qiQJgiZ1SIY0j78KxsSbS38IgSxCONatSK90+dEG40SgP04bYcAuf2OvrR8KbIV+o2Zl6Htvjb5uwOV21xfWb/ACcvxD27TDMzY3PRCAh470fOsvSoNVQPz8CDG4Qc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru; spf=pass smtp.mailfrom=amicon.ru; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b=HPME+MJe; arc=none smtp.client-ip=77.108.111.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amicon.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b="HPME+MJe" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; d=amicon.ru; s=mail; c=simple/simple; t=1787566990; h=from:subject:to:date:message-id; bh=IcMqAquUYIjmqqC5ZhMeop2YaOzLFYBW8X3+dvdhgKs=; b=HPME+MJe+sz6cMwEGSpMFKysCDcKWRI/GrCdYtKbgpQGCHWvGl2HU0ldS5Ij+kWwJifojOUUaeA 8+ESDhuHmU2yI8hL7badonMyYsQiryzjyYm7Dmt7UzGyP8kCTD72UDWmIgtKOakETJYePj8KNqanc htmdktpfmnWrfy2fnHa/N8VMUNgHEt96j1cviHkzwYCQYZro+fRH6lRaKaiae6NK6RCpSdZtn3f1A fmhYZpE8/bjxw392nNy3mhxL82PN7Oklo3RwIwwTHWQgsAhLg3gRL+qQTvuvbTa9MqDGmLrC21v9Z n81JFqVGNm9TWaIngxe0u6edSMjax6paCJpA== Received: from localhost.localdomain (192.168.0.250) by mail.amicon.lan (192.168.0.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.27; Mon, 24 Aug 2026 13:23:07 +0300 From: Aleksandr Khromov To: , CC: , , , , , , Subject: [PATCH v2 1/3] ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in Date: Mon, 24 Aug 2026 13:22:46 +0300 Message-ID: <20260824102248.178152-2-haa@amicon.ru> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20260824102248.178152-1-haa@amicon.ru> References: <20260821135801.3790290-1-haa@amicon.ru> <20260824102248.178152-1-haa@amicon.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: mail.amicon.lan (192.168.0.59) To mail.amicon.lan (192.168.0.59) Content-Type: text/plain; charset="utf-8" smb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION, that is the whole of struct object_id_info, but writes only 46 of them: - objid[] is 16 bytes, and when the volume UUID is not available only sizeof(stfs.f_fsid) (8) bytes are copied into it; - extended_info.version_string[] is STRING_LENGTH (28) bytes, and only strlen("1.1.0") (5) bytes are copied into it. The response buffer is zeroed on allocation (kvzalloc() in smb2_allocate_rsp_buf()), so for a standalone request the remaining 31 bytes are zero. In a compound request they need not be. The offset of the next response is advanced by the length pinned for the previous one, so if a preceding command wrote its reply into the buffer and then failed, smb2_set_err_rsp() pins only the short error response and the next reply lands inside the area that has already been written. Only the header is cleared there: memset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); The client then receives up to 31 bytes of a response it was not meant to see, including one that failed with an access denied error. Clear the structure before filling it in. As a side effect version_string is now NUL terminated. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Suggested-by: ChenXiaoSong Cc: stable@vger.kernel.org Signed-off-by: Aleksandr Khromov --- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 76f63f9adc72..a66a7a12477b 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -6092,6 +6092,7 @@ static int smb2_get_info_filesystem(struct ksmbd_work= *work, struct object_id_info *info; =20 info =3D (struct object_id_info *)(rsp->Buffer); + memset(info, 0, sizeof(*info)); =20 if (path.mnt->mnt_sb->s_uuid_len =3D=3D 16) memcpy(info->objid, path.mnt->mnt_sb->s_uuid.b, --=20 2.48.1 From nobody Mon Sep 28 08:46:16 2026 Received: from mail.amicon.ru (unknown [77.108.111.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 02C0F374A1F; Mon, 24 Aug 2026 10:23:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=77.108.111.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787567001; cv=none; b=RfpqSNHOuM2cUT9VvQe+hYW/2Mtn4dN74Y/5sCXYfSlZ0lpru+zosRR6/bIQaPehhFAP1YHI8jPjKOvlF/77/ogj4g2tkrjScnzeUfmE8VzSFOczDcz87MGxQDch5/GgIrNvgw8fDKO/ldEtiXXXI23TTSbSRRK3HzeZ2IekBI4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787567001; c=relaxed/simple; bh=PT5i94gEJTHx8AkejakDwe70KVxq5oziFyZS3Bd0d2g=; h=Content-Type:From:To:CC:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version; b=Hk5T5bFy2ze9fsK7zOV2C2cdzIgKcAISUbU4nWsLSaLaqc3Y22pExg0Rd+egWRbgtesP9MUald2RVEO/lKdIThtf2ShlkHlM8KZnQVwak2xr3FS+GQXBAUv2dQYP5aLLIQmdC8L6+HhFLwRDz+6y7e10gwAjZxYDhYFecvv1pxM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru; spf=pass smtp.mailfrom=amicon.ru; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b=MGmB7AHJ; arc=none smtp.client-ip=77.108.111.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amicon.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b="MGmB7AHJ" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; d=amicon.ru; s=mail; c=simple/simple; t=1787566997; h=from:subject:to:date:message-id; bh=PT5i94gEJTHx8AkejakDwe70KVxq5oziFyZS3Bd0d2g=; b=MGmB7AHJ0iws7wnWwp2nK2cdmz937CNJqD5wuXyQNWA0yd50ihSfFOkacuqQcUf6xgVhcpWVWgg y55j7Fl+WGTzk7unt366w3TDDZ0pjSizr7KJ0zFT4Wge2GzbZoTcbJwsEKIYO45XLtohRKwOjvnyD RBdu0Zkr8C6xSRySQbU58BShDzti2bKbuCQridZvqgm9md4csRDIaCNimRVyxUNyD1kqxpxIU4YRO VRrlwAs08fBVd3H7UJBqLnx+aNOgVZNBZQJjIdPmmjzG54+Ak5xBrBoUnZBK3+Ey7z1t1VuDg40ku M0KbPfLhhEdD/5Z12SXPCFbSl1pKMo/LVEBw== Received: from localhost.localdomain (192.168.0.250) by mail.amicon.lan (192.168.0.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.27; Mon, 24 Aug 2026 13:23:14 +0300 From: Aleksandr Khromov To: , CC: , , , , , , Subject: [PATCH v2 2/3] ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION Date: Mon, 24 Aug 2026 13:22:47 +0300 Message-ID: <20260824102248.178152-3-haa@amicon.ru> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20260824102248.178152-1-haa@amicon.ru> References: <20260821135801.3790290-1-haa@amicon.ru> <20260824102248.178152-1-haa@amicon.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: mail.amicon.lan (192.168.0.59) To mail.amicon.lan (192.168.0.59) Content-Type: text/plain; charset="utf-8" smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer. The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared. ksmbd does not implement quota tracking, so report no control flags. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Aleksandr Khromov --- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index a66a7a12477b..5e83ad4f085e 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -6145,6 +6145,7 @@ static int smb2_get_info_filesystem(struct ksmbd_work= *work, info->FreeSpaceStopFiltering =3D 0; info->DefaultQuotaThreshold =3D cpu_to_le64(SMB2_NO_FID); info->DefaultQuotaLimit =3D cpu_to_le64(SMB2_NO_FID); + info->FileSystemControlFlags =3D 0; info->Padding =3D 0; rsp->OutputBufferLength =3D cpu_to_le32(48); break; --=20 2.48.1 From nobody Mon Sep 28 08:46:16 2026 Received: from mail.amicon.ru (mail.amicon.ru [77.108.111.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A13D375F82; Mon, 24 Aug 2026 10:23:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=77.108.111.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787567032; cv=none; b=DaLol71wVNUfl6geWruQeJT7qmtxm1xkCDefqP9zEyxHvVCA3nGrfIPiE+fAaSIjIHkMWF55RDQBLEHImKD/vepWeCgSQKYxNAWJ8Zhb+udleSoREKA0lJkeNdCDJXVoUM8NNAx+OWGV4BslHVM4EgCRtm+BBraAVrJGd7MaADE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787567032; c=relaxed/simple; bh=GNNIcCbb8CKA2CqCDfT6NtZhJfbAbQssC+W59hK9jFc=; h=Content-Type:From:To:CC:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version; b=KGgi81+PcUH7Kw+EsS1FYIWbamN5b8XbLzyrfmWZaSAmSmw7Bb3QSVxDoJCCSrq48UPP3PmxrOGSzd04toytwanQjdgUcr+Up4fjASbw1GMYiPwQ5JWHWTISnONmZmQ+jRKLLaWNnjHKLKeX342PyihozxkScnA1HkGhuevfMT8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru; spf=pass smtp.mailfrom=amicon.ru; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b=F403FoXN; arc=none smtp.client-ip=77.108.111.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amicon.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b="F403FoXN" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; d=amicon.ru; s=mail; c=simple/simple; t=1787567028; h=from:subject:to:date:message-id; bh=GNNIcCbb8CKA2CqCDfT6NtZhJfbAbQssC+W59hK9jFc=; b=F403FoXNd8OiFt7F1ctldSPMrijzQjL9helKxEm8kElQxuJ8NDWdGhzknlgNwJjGyr0QCafzXCO 7eadVRA4VgCLt75hQfhRsnrozK1hWY9gLLX046ydpqS9Oujm7wsvXlOZeOeyYvpSAIPM3wVg8Y9LG QGThXyen2vQenQrAZQI8bhlRLcmGJLtX/CfqXYN8IxOrHBgklLWdvHkAeR1qF0MqPsuCmNwahJ9Ac 5cTfsTfQ4YZIegqLF0Wv4y391q6Jl0HOOtFn5KEqoRqHRbbWoNvfjLE+fItn2MXuWlSYdQ0hpRH98 c1qB3troVGftxx5dmV11Lao3bidH31LlkisQ== Received: from localhost.localdomain (192.168.0.250) by mail.amicon.lan (192.168.0.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.27; Mon, 24 Aug 2026 13:23:43 +0300 From: Aleksandr Khromov To: , CC: , , , , , , Subject: [PATCH v2 3/3] ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION Date: Mon, 24 Aug 2026 13:22:48 +0300 Message-ID: <20260824102248.178152-4-haa@amicon.ru> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20260824102248.178152-1-haa@amicon.ru> References: <20260821135801.3790290-1-haa@amicon.ru> <20260824102248.178152-1-haa@amicon.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: mail.amicon.lan (192.168.0.59) To mail.amicon.lan (192.168.0.59) Content-Type: text/plain; charset="utf-8" smb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION, that is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns FileSysIdentifier. Those eight bytes go to the client as they are found in the response buffer. The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared. Report the file system id statfs() returned, which is what the field is for; ksmbd already hands the same value out in FS_OBJECT_ID_INFORMATION when the volume UUID is not available. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Aleksandr Khromov --- fs/smb/server/smb2pdu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 5e83ad4f085e..7f200ba103ba 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -6167,6 +6167,8 @@ static int smb2_get_info_filesystem(struct ksmbd_work= *work, info->UserBlocksAvail =3D cpu_to_le64(stfs.f_bavail); info->TotalFileNodes =3D cpu_to_le64(stfs.f_files); info->FreeFileNodes =3D cpu_to_le64(stfs.f_ffree); + memcpy(&info->FileSysIdentifier, &stfs.f_fsid, + sizeof(stfs.f_fsid)); rsp->OutputBufferLength =3D cpu_to_le32(56); } break; --=20 2.48.1