Re: [PATCH 6.12.y 2/2] smb: client: fix fattr leaking on wsl_to_fattr() failure

[Greg KH <greg@kroah.com>]

On Tue, Sep 22, 2026 at 05:25:06PM -0400, Sasha Levin wrote:
> From: Paulo Alcantara <pc@manguebit.org>
> 
> [ Upstream commit e1253a82bb4c0fed6706a5839fc8b6e01be1abe2 ]
> 
> wsl_to_fattr() mutates fattr fields as it parses each WSL EA.  If
> validation later fails, the function returns false with partially
> mutated fattr fields that callers do not reset.
> 
> Fix this by parsing into local variables and only committing them to
> fattr on success.
> 
> Closes: https://sashiko.dev/#/patchset/20260906200517.725015-1-pc%40manguebit.org
> Fixes: 78e26bec4d6d ("smb: client: parse uid, gid, mode and dev from WSL reparse points")
> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
> Cc: David Howells <dhowells@redhat.com>
> Cc: Tom Talpey <tom@talpey.com>
> Cc: Shyam Prasad N <sprasad@microsoft.com>
> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
> Cc: Bharath SM <bharathsm@microsoft.com>
> Cc: Namjae Jeon <linkinjeon@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  fs/smb/client/reparse.c | 34 +++++++++++++++++++---------------
>  1 file changed, 19 insertions(+), 15 deletions(-)
> 
> diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c
> index bb2caf01cd895..7a7189f547efd 100644
> --- a/fs/smb/client/reparse.c
> +++ b/fs/smb/client/reparse.c
> @@ -680,29 +680,30 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data,
>  			 u32 tag, struct cifs_fattr *fattr)
>  {
>  	unsigned int sbflags = cifs_sb_flags(cifs_sb);
> +	kuid_t uid = cifs_sb->ctx->linux_uid;
> +	kgid_t gid = cifs_sb->ctx->linux_gid;
>  	struct smb2_file_full_ea_info *ea;
>  	bool have_xattr_dev = false;
> +	dev_t rdev = 0;
> +	umode_t mode;
>  	u32 next = 0;
>  
> -	fattr->cf_uid = cifs_sb->ctx->linux_uid;
> -	fattr->cf_gid = cifs_sb->ctx->linux_gid;
> -
> -	fattr->cf_mode &= ~S_IFMT;
> +	mode = fattr->cf_mode & ~S_IFMT;
>  	switch (tag) {
>  	case IO_REPARSE_TAG_LX_SYMLINK:
> -		fattr->cf_mode |= S_IFLNK;
> +		mode |= S_IFLNK;
>  		break;
>  	case IO_REPARSE_TAG_LX_FIFO:
> -		fattr->cf_mode |= S_IFIFO;
> +		mode |= S_IFIFO;
>  		break;
>  	case IO_REPARSE_TAG_AF_UNIX:
> -		fattr->cf_mode |= S_IFSOCK;
> +		mode |= S_IFSOCK;
>  		break;
>  	case IO_REPARSE_TAG_LX_CHR:
> -		fattr->cf_mode |= S_IFCHR;
> +		mode |= S_IFCHR;
>  		break;
>  	case IO_REPARSE_TAG_LX_BLK:
> -		fattr->cf_mode |= S_IFBLK;
> +		mode |= S_IFBLK;
>  		break;
>  	}
>  
> @@ -726,26 +727,29 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data,
>  
>  		if (!strncmp(name, SMB2_WSL_XATTR_UID, nlen)) {
>  			if (!(sbflags & CIFS_MOUNT_OVERR_UID))
> -				fattr->cf_uid = wsl_make_kuid(cifs_sb, v);
> +				uid = wsl_make_kuid(cifs_sb, v);
>  		} else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen)) {
>  			if (!(sbflags & CIFS_MOUNT_OVERR_GID))
> -				fattr->cf_gid = wsl_make_kgid(cifs_sb, v);
> +				gid = wsl_make_kgid(cifs_sb, v);
>  		} else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) {
>  			/* File type in reparse point tag and in xattr mode must match. */
> -			if (S_DT(fattr->cf_mode) != S_DT(get_unaligned_le32(v)))
> +			if (S_DT(mode) != S_DT(get_unaligned_le32(v)))
>  				return false;
> -			fattr->cf_mode = (umode_t)get_unaligned_le32(v);
> +			mode = get_unaligned_le32(v);
>  		} else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) {
> -			fattr->cf_rdev = reparse_mkdev(v);
> +			rdev = reparse_mkdev(v);
>  			have_xattr_dev = true;
>  		}
>  	} while (next);
>  out:
> -
>  	/* Major and minor numbers for char and block devices are mandatory. */
>  	if (!have_xattr_dev && (tag == IO_REPARSE_TAG_LX_CHR || tag == IO_REPARSE_TAG_LX_BLK))
>  		return false;
>  
> +	fattr->cf_uid = uid;
> +	fattr->cf_gid = gid;
> +	fattr->cf_mode = mode;
> +	fattr->cf_rdev = rdev;
>  	return true;
>  }
>  
> -- 
> 2.53.0
> 
> 

Did not apply