[PATCH v2 1/1] smb: client: check posix_info_parse() in cifs_posix_to_fattr()

From: Zihan Xi <[email protected]>

cifs_posix_to_fattr() always called sid_to_id() with parsed owner/group
SIDs even when posix_info_parse() failed, allowing use of uninitialized
stack data for ID mapping on malformed SMB_FIND_FILE_POSIX_INFO entries.

Only call sid_to_id() after a successful parse. Fill the fixed
smb2_posix_info fields first so a malformed trailing payload still
yields usable inode metadata.

Fixes: 9934430e2178 ("SMB3.1.1: Fix ids returned in POSIX query dir")
Cc: [email protected]
Reported-by: Yuan Tan <[email protected]>
Reported-by: Yifan Wu <[email protected]>
Reported-by: Juefei Pu <[email protected]>
Reported-by: Xin Liu <[email protected]>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
changes in v2:
  - Only call sid_to_id() after posix_info_parse() >= 0; still populate
    fixed smb2_posix_info fields when trailing SID payload is malformed
    (Steve French review)
  - v1 Link: https://lore.kernel.org/all/60461bf5482d51ebd950fc84fd19ece9ac1917fb.1782898568.git.xizh2024@lzu.edu.cn/

 fs/smb/client/readdir.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index e860fa08b5e3..91182dce7248 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -245,8 +245,6 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info,
 {
 	struct smb2_posix_info_parsed parsed;
 
-	posix_info_parse(info, NULL, &parsed);
-
 	memset(fattr, 0, sizeof(*fattr));
 	fattr->cf_uniqueid = le64_to_cpu(info->Inode);
 	fattr->cf_bytes = le64_to_cpu(info->AllocationSize);
@@ -282,8 +280,12 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info,
 		 le32_to_cpu(info->ReparseTag),
 		 le32_to_cpu(info->Mode));
 
-	sid_to_id(cifs_sb, &parsed.owner, fattr, SIDOWNER);
-	sid_to_id(cifs_sb, &parsed.group, fattr, SIDGROUP);
+	if (posix_info_parse(info, NULL, &parsed) >= 0) {
+		sid_to_id(cifs_sb, &parsed.owner, fattr, SIDOWNER);
+		sid_to_id(cifs_sb, &parsed.group, fattr, SIDGROUP);
+	} else {
+		cifs_dbg(VFS, "Invalid POSIX info payload\n");
+	}
 }
 
 static void __dir_info_to_fattr(struct cifs_fattr *fattr, const void *info)
-- 
2.43.0