[PATCH] ksmbd: use copied ACE count when walking DACL in set_ntacl_dacl

set_ntacl_dacl() copies ACEs from the stored, attacker-controlled DACL
into pndace but may copy fewer than nt_num_aces (it skips ACEs with a bad
sid.num_subauth and breaks on size overflow). It still passes the raw
nt_num_aces to set_posix_acl_entries_dacl(), whose dedup loop then walks
that many ACEs and, past the last one actually copied, reads
sub_auth[num_subauth - 1] from uninitialized buffer memory - an
out-of-bounds read whose offset comes from that stale byte.

Pass num_aces, the count actually copied, instead. For well-formed DACLs
num_aces equals nt_num_aces, so behavior is unchanged.

  UBSAN: array-index-out-of-bounds in fs/smb/server/smbacl.c:651:27
  index -1 is out of range for type '__le32 [15]'
  Workqueue: ksmbd-io handle_ksmbd_work
  Call Trace:
   __ubsan_handle_out_of_bounds (lib/ubsan.c:455)
   set_posix_acl_entries_dacl (fs/smb/server/smbacl.c:651)
   build_sec_desc (fs/smb/server/smbacl.c:776 fs/smb/server/smbacl.c:1078)
   smb2_query_info (fs/smb/server/smb2pdu.c:6269 fs/smb/server/smb2pdu.c:6339)
   handle_ksmbd_work (fs/smb/server/server.c:308)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3486)
   kthread (kernel/kthread.c:436)

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Reported-by: [email protected]
Signed-off-by: Xiang Mei (Microsoft) <[email protected]>
---
 fs/smb/server/smbacl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 67b39b4d218c..957547157ef8 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -774,7 +774,7 @@ static void set_ntacl_dacl(struct mnt_idmap *idmap,
 	}
 
 	set_posix_acl_entries_dacl(idmap, pndace, fattr,
-				   &num_aces, &size, nt_num_aces);
+				   &num_aces, &size, num_aces);
 	pndacl->num_aces = cpu_to_le16(num_aces);
 	pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
 }
-- 
2.43.0