[PATCH 5/8] ksmbd: report actual xattr value length in stream enumeration

"Gaël Blivet-Bailly" <[email protected]>
Newsgroups org.kernel.vger.linux-cifs
Message-ID <[email protected]>
From: Gael Blivet <[email protected]>

get_file_stream_info() (FileStreamInformation QUERY_INFO) reported
each enumerated stream's StreamSize/StreamAllocationSize as
stream_name_len -- the byte length of the stream's *name*, not its
data. This is the same bug class already fixed for EndOfFile/
AllocationSize on an open stream handle (ksmbd_stream_eof(), added
earlier in this series), just missed at this second site: a client
enumerating streams sees a size derived from the name string length
instead of the stream's actual content length, inconsistent with
what querying the same stream by handle reports.

Compute the real value length the same way ksmbd_stream_eof() does,
via ksmbd_vfs_casexattr_len() on the already-known xattr key.

Signed-off-by: Gael Blivet <[email protected]>
---
 fs/smb/server/smb2pdu.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index ffdae74b6..ca3d4985a 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5865,8 +5865,24 @@ static int get_file_stream_info(struct ksmbd_work *work,
 		streamlen *= 2;
 		kfree(stream_buf);
 		file_info->StreamNameLength = cpu_to_le32(streamlen);
-		file_info->StreamSize = cpu_to_le64(stream_name_len);
-		file_info->StreamAllocationSize = cpu_to_le64(stream_name_len);
+		{
+			/*
+			 * stream_name_len is the byte length of the xattr's
+			 * *name*, not its value -- same class of bug
+			 * ksmbd_stream_eof() (smb2pdu.c) already fixes for
+			 * EndOfFile/AllocationSize on a stream handle; this
+			 * enumeration path needs the same real xattr value
+			 * length, not the name length reused as a size.
+			 */
+			ssize_t slen = ksmbd_vfs_casexattr_len(file_mnt_idmap(fp->filp),
+							       path->dentry,
+							       stream_name,
+							       strlen(stream_name));
+			loff_t ssize = slen < 0 ? 0 : (loff_t)slen;
+
+			file_info->StreamSize = cpu_to_le64(ssize);
+			file_info->StreamAllocationSize = cpu_to_le64(ssize);
+		}
 
 		nbytes += next;
 		buf_free_len -= next;
-- 
2.43.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.