Re: [PATCH] ksmbd: use copied ACE count when walking DACL in set_ntacl_dacl

On Thu, Jul 23, 2026 at 8:59 AM Xiang Mei (Microsoft) <[email protected]> wrote:
>
> set_ntacl_dacl() copies ACEs from the stored, attacker-controlled DACL
> into pndace but may copy fewer than nt_num_aces (it skips ACEs with a bad
> sid.num_subauth and breaks on size overflow). It still passes the raw
> nt_num_aces to set_posix_acl_entries_dacl(), whose dedup loop then walks
> that many ACEs and, past the last one actually copied, reads
> sub_auth[num_subauth - 1] from uninitialized buffer memory - an
> out-of-bounds read whose offset comes from that stale byte.
>
> Pass num_aces, the count actually copied, instead. For well-formed DACLs
> num_aces equals nt_num_aces, so behavior is unchanged.
>
>   UBSAN: array-index-out-of-bounds in fs/smb/server/smbacl.c:651:27
>   index -1 is out of range for type '__le32 [15]'
>   Workqueue: ksmbd-io handle_ksmbd_work
>   Call Trace:
>    __ubsan_handle_out_of_bounds (lib/ubsan.c:455)
>    set_posix_acl_entries_dacl (fs/smb/server/smbacl.c:651)
>    build_sec_desc (fs/smb/server/smbacl.c:776 fs/smb/server/smbacl.c:1078)
>    smb2_query_info (fs/smb/server/smb2pdu.c:6269 fs/smb/server/smb2pdu.c:6339)
>    handle_ksmbd_work (fs/smb/server/server.c:308)
>    process_one_work (kernel/workqueue.c:3322)
>    worker_thread (kernel/workqueue.c:3486)
>    kthread (kernel/kthread.c:436)
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Reported-by: [email protected]
> Signed-off-by: Xiang Mei (Microsoft) <[email protected]>
Thanks for the patch.
Could you please check whether this issue is still present in the
current ksmbd-for-next-next tree?