ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()

[PATCH ksmbd-for-next] ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()

Posted by Giorgi Kobakhia 1 week, 6 days ago

When the large dacl_offset is provided, dacl_offset + sizeof(struct
smb_acl) overflows on 32-bit builds and the check is passed,
Which makes le16_to_cpu(ppdacl_ptr->size) read out-of-bounds. This
only happens for dacl_offset in range [0xFFFFFFF8, 0xFFFFFFFF]. So
the oob read is max 8 bytes preceding the allocated ppntsd.

    unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
    int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;

    if (!dacl_offset ||
	(dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
	    goto out;

Commit beff0bc9d69b ("ksmbd: fix overflow in dacloffset bounds check")
fixes similar checks in other functions. But leaves this one out,
because it is only valid for 32-bit builds.

Reproduced on 32-bit ARM with KASAN, by a client sending SMB2
SET_INFO(SEC) with dacloffset=0xfffffff8, then QUERY_INFO(SEC) on the
same file:

 BUG: KASAN: slab-out-of-bounds in build_sec_desc (fs/smb/server/smbacl.c:1105)
 Read of size 2 at addr c2a273fa by task kworker/1:1/35
 CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Not tainted 7.3.0-rc2+ #5
 Workqueue: ksmbd-io handle_ksmbd_work
 Call trace:
  kasan_check_range from build_sec_desc (fs/smb/server/smbacl.c:1105)
  build_sec_desc from smb2_query_info (fs/smb/server/smb2pdu.c:7676)
  smb2_query_info from handle_ksmbd_work (fs/smb/server/server.c:160)
  handle_ksmbd_work from process_one_work (kernel/workqueue.c:3401)
  process_one_work from worker_thread (kernel/workqueue.c:3473)
  worker_thread from kthread (kernel/kthread.c:436)

Add overflow check.

Fixes: 8f0541186e9a ("ksmbd: fix heap-based overflow in set_ntacl_dacl()")
Cc: stable@vger.kernel.org
Assisted-by: LLM claude
Tested-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Giorgi Kobakhia <gkobakhi@asu.edu>
---
 fs/smb/server/smbacl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 7c60520f3b63..e75247915c87 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1097,9 +1097,12 @@ int build_sec_desc(struct mnt_idmap *idmap,
 			struct smb_acl *ppdacl_ptr;
 			unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
 			int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;
+			size_t dacl_struct_end;
 
 			if (!dacl_offset ||
-			    (dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
+			    check_add_overflow(dacl_offset, sizeof(struct smb_acl),
+					       &dacl_struct_end) ||
+			    dacl_struct_end > (size_t)ppntsd_size)
 				goto out;
 
 			ppdacl_ptr = (struct smb_acl *)((char *)ppntsd + dacl_offset);
-- 
2.43.0

Re: [PATCH ksmbd-for-next] ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()

Posted by Namjae Jeon 1 week, 6 days ago

On Sat, Sep 12, 2026 at 9:09 AM Giorgi Kobakhia <gkobakhi@asu.edu> wrote:
>
> When the large dacl_offset is provided, dacl_offset + sizeof(struct
> smb_acl) overflows on 32-bit builds and the check is passed,
> Which makes le16_to_cpu(ppdacl_ptr->size) read out-of-bounds. This
> only happens for dacl_offset in range [0xFFFFFFF8, 0xFFFFFFFF]. So
> the oob read is max 8 bytes preceding the allocated ppntsd.
>
>     unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
>     int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;
>
>     if (!dacl_offset ||
>         (dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
>             goto out;
>
> Commit beff0bc9d69b ("ksmbd: fix overflow in dacloffset bounds check")
> fixes similar checks in other functions. But leaves this one out,
> because it is only valid for 32-bit builds.
>
> Reproduced on 32-bit ARM with KASAN, by a client sending SMB2
> SET_INFO(SEC) with dacloffset=0xfffffff8, then QUERY_INFO(SEC) on the
> same file:
>
>  BUG: KASAN: slab-out-of-bounds in build_sec_desc (fs/smb/server/smbacl.c:1105)
>  Read of size 2 at addr c2a273fa by task kworker/1:1/35
>  CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Not tainted 7.3.0-rc2+ #5
>  Workqueue: ksmbd-io handle_ksmbd_work
>  Call trace:
>   kasan_check_range from build_sec_desc (fs/smb/server/smbacl.c:1105)
>   build_sec_desc from smb2_query_info (fs/smb/server/smb2pdu.c:7676)
>   smb2_query_info from handle_ksmbd_work (fs/smb/server/server.c:160)
>   handle_ksmbd_work from process_one_work (kernel/workqueue.c:3401)
>   process_one_work from worker_thread (kernel/workqueue.c:3473)
>   worker_thread from kthread (kernel/kthread.c:436)
>
> Add overflow check.
>
> Fixes: 8f0541186e9a ("ksmbd: fix heap-based overflow in set_ntacl_dacl()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM claude
> Tested-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Giorgi Kobakhia <gkobakhi@asu.edu>
Applied it to #ksmbd-for-next.
Thanks!