Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/fs
History
Shota Zaizen c1d95c995d ksmbd: validate inherited ACE SID length 
commit 996454bc0d upstream.

smb_inherit_dacl() walks the parent directory DACL loaded from the
security descriptor xattr. It verifies that each ACE contains the fixed
SID header before using it, but does not verify that the variable-length
SID described by sid.num_subauth is fully contained in the ACE.

A malformed inheritable ACE can advertise more subauthorities than are
present in the ACE. compare_sids() may then read past the ACE.
smb_set_ace() also clamps the copied destination SID, but used the
unchecked source SID count to compute the inherited ACE size. That could
advance the temporary inherited ACE buffer pointer and nt_size accounting
past the allocated buffer.

Fix this by validating the parent ACE SID count and SID length before
using the SID during inheritance. Compute the inherited ACE size from the
copied SID so the size matches the bounded destination SID. Reject the
inherited DACL if size accumulation would overflow smb_acl.size or the
security descriptor allocation size.

Fixes: e2f34481b2 ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Shota Zaizen <s@zaizen.me>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-14 15:31:20 +02:00
..
9p 9p: fix access mode flags being ORed instead of replaced 2026-05-07 06:14:11 +02:00
adfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
affs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
afs fs: afs: revert mmap_prepare() change 2026-05-07 06:13:43 +02:00
autofs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
befs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btrfs btrfs: fix missing last_unlink_trans update when removing a directory 2026-05-14 15:31:12 +02:00
cachefiles cachefiles: fix incorrect dentry refcount in cachefiles_cull() 2026-03-31 11:52:08 +02:00
ceph ceph: only d_add() negative dentries when they are unhashed 2026-05-07 06:14:13 +02:00
coda Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
configfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cramfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
crypto Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
debugfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devpts Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dlm Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ecryptfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
efivarfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
efs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
erofs erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() 2026-05-07 06:14:13 +02:00
exfat Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
exportfs fs: add helpers name_is_dot{,dot,_dotdot} 2026-01-29 10:06:59 +01:00
ext2 ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() 2026-05-07 06:13:48 +02:00
ext4 ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() 2026-05-07 06:14:08 +02:00
f2fs f2fs: fix fsck inconsistency caused by FGGC of node block 2026-05-14 15:31:18 +02:00
fat Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
freevxfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fuse lsm: add backing_file LSM hooks 2026-05-07 06:14:01 +02:00
gfs2 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hfsplus hfsplus: fix held lock freed on hfsplus_fill_super() 2026-05-14 15:31:20 +02:00
hostfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hpfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hugetlbfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iomap iomap: fix lockdep complaint when reads fail 2026-03-24 09:14:46 +01:00
isofs isofs: validate block number from NFS file handle in isofs_export_iget 2026-05-14 15:31:13 +02:00
jbd2 jbd2: fix deadlock in jbd2_journal_cancel_revoke() 2026-05-07 06:13:49 +02:00
jffs2 Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
jfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
kernfs kernfs: make directory seek namespace-aware 2026-04-09 14:36:52 +02:00
lockd Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
minix vfs-7.0-rc2.fixes 2026-02-25 10:34:23 -08:00
netfs netfs: Fix the handling of stream->front by removing it 2026-03-26 15:18:45 +01:00
nfs NFSv4.1: Apply session size limits on clone path 2026-05-07 06:14:14 +02:00
nfs_common
nfsd nfsd-7.0 fixes: 2026-03-18 14:27:11 -07:00
nilfs2 nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map 2026-04-22 13:32:23 +02:00
nls
notify fanotify: fix false positive on permission events 2026-05-14 15:31:07 +02:00
ntfs3 ntfs3: fix integer overflow in run_unpack() volume boundary check 2026-05-07 06:14:14 +02:00
ocfs2 ocfs2: split transactions in dio completion to avoid credit exhaustion 2026-05-07 06:13:44 +02:00
omfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
openpromfs
orangefs Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
overlayfs ovl: fix verity lazy-load guard broken by fsverity_active() semantic change 2026-05-14 15:31:09 +02:00
proc vfs-7.0-rc2.fixes 2026-02-25 10:34:23 -08:00
pstore Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
qnx4 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
qnx6 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
quota Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ramfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
resctrl Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
romfs mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
smb ksmbd: validate inherited ACE SID length 2026-05-14 15:31:20 +02:00
squashfs Squashfs: check metadata block offset is within range 2026-02-24 11:13:27 -08:00
sysfs sysfs: attribute_group: Respect is_visible_const() when changing owner 2026-05-07 06:13:42 +02:00
tests fs/tests: exec: Remove bad test vector 2026-03-18 11:41:53 -07:00
tracefs eventfs: Hold eventfs_mutex and SRCU when remount walks events 2026-05-14 15:31:13 +02:00
ubifs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
udf udf: reject descriptors with oversized CRC length 2026-05-14 15:31:11 +02:00
ufs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
unicode Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vboxsf Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
verity fsverity: add dependency on 64K or smaller pages 2026-03-02 21:05:34 -08:00
xfs xfs: fix a resource leak in xfs_alloc_buftarg() 2026-05-07 06:14:02 +02:00
zonefs Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
aio.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
anon_inodes.c
attr.c fs,fsverity: reject size changes on fsverity files in setattr_prepare 2026-01-29 09:39:41 -08:00
backing-file.c lsm: add backing_file LSM hooks 2026-05-07 06:14:01 +02:00
bad_inode.c
binfmt_elf.c rseq: slice ext: Ensure rseq feature size differs from original rseq size 2026-02-23 11:19:19 +01:00
binfmt_elf_fdpic.c binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4 2026-02-23 16:09:00 -08:00
binfmt_flat.c
binfmt_misc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
binfmt_script.c
bpf_fs_kfuncs.c
buffer.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
char_dev.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c
coredump.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
d_path.c
dax.c
dcache.c dcache: Limit the minimal number of bucket to two 2026-04-22 13:32:19 +02:00
direct-io.c
drop_caches.c
eventfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
eventpoll.c eventpoll: defer struct eventpoll free to RCU grace period 2026-04-02 21:45:02 +02:00
exec.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fcntl.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fhandle.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
file.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
file_attr.c vfs-7.0-rc2.fixes 2026-02-25 10:34:23 -08:00
file_table.c lsm: add backing_file LSM hooks 2026-05-07 06:14:01 +02:00
filesystems.c
fs-writeback.c writeback: Fix use after free in inode_switch_wbs_work_fn() 2026-04-27 07:30:18 -06:00
fs_context.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
fs_dirent.c
fs_parser.c
fs_pin.c
fs_struct.c
fserror.c
fsopen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
init.c struct filename series 2026-02-09 16:58:28 -08:00
inode.c fsverity updates for 7.0 2026-02-12 10:41:34 -08:00
internal.h lsm: add backing_file LSM hooks 2026-05-07 06:14:01 +02:00
ioctl.c
Kconfig
Kconfig.binfmt
kernel_read_file.c
libfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
locks.c NFSD 7.0 Release Notes 2026-02-12 08:23:53 -08:00
Makefile vfs-7.0-rc1.nullfs 2026-02-09 13:41:34 -08:00
mbcache.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
mnt_idmapping.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
mount.h
mpage.c mpage: Provide variant of mpage_writepages() with own optional folio handler 2026-03-27 17:01:36 +01:00
namei.c vfs: fix docstring of hash_name() 2026-03-19 11:18:01 +01:00
namespace.c vfs-7.0-rc2.fixes 2026-02-25 10:34:23 -08:00
nsfs.c nsfs: tighten permission checks for handle opening 2026-02-27 22:00:11 +01:00
nullfs.c
open.c struct filename series 2026-02-09 16:58:28 -08:00
pidfs.c vfs-7.0-rc2.fixes 2026-02-25 10:34:23 -08:00
pipe.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
pnode.c
pnode.h
posix_acl.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
proc_namespace.c
read_write.c
readdir.c
remap_range.c
select.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
seq_file.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
signalfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
splice.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stack.c
stat.c
statfs.c
super.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sync.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
sysctls.c
timerfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
userfaultfd.c userfaultfd: allow registration of ranges below mmap_min_addr 2026-05-07 06:14:04 +02:00
utimes.c
xattr.c