From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793830921; b=BfXpFf1zGq+55NYJCzay85YAvJmf8/AOsHgTC+3dkahFJc4UZA229bQCUF6p7mNyQOkO gch2BXRVNXXLNHnv0gQF8Gy27HcVeNYQdaTGpQ/ldIR92Xwkn8k4GvdJ4aQilTraJnzlT vbvuaU+mcUH4CPZHJdYS8AntJ2HswFy/C9BcjkWHY41aA4eW9uKXEfLlYU1R05lWWE3tO wgB2snvVb9rTo5FdrSv6LVQo9Qin/i2dr4hZsjAHgelB2yPSicazj0FCnpCrAnJGluZgo 9yV0naiIKjoXsd9cHE7wwQiAy30mzV6F11I+H3a6TVLhEvuOvjk0bK1R/TCHDEX9gRQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793830921; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=i/po77MkNj8BZCv85Fr9gWIliJf9/rsYJo5lI5Q8/hY=; b=xgIESvN0ITJGTtRUfXNXWlmPAi/NF41FZDrYjbJEKfr5E2+Xek/8MBPH+MLTTgVC1DBw EhkDlH5ns8tAhm7p8Ey4HYvgx7qKGXunb1GO8AfnCg+zt6LpA7KBmER7+CPB2qClgKsYD AG+Yx3FD257ZYm5nGejTYPsNqodZT/A+AgIpbJ4HUz/OrdEtSoIbbsYjOWCeWRjmNPYV9 atKAyW3faHt8hau3YkGDqA5CdlTZGmDoXVRlYR5S5HsZkTqdnqirO5k6t7oJhjaLAi8jl iG25S67MHV1tG81IjsHA5i72Fl18Sxk9T2uw4dGCkiQ7jUHWSN+jyX+7rxvCf3vmBOg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ihy6COFH; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57913606A33B; Wed, 4 Nov 2026 22:22:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ihy6COFH Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3B4E1F000C1; Wed, 4 Nov 2026 22:22:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793830921; bh=i/po77MkNj8BZCv85Fr9gWIliJf9/rsYJo5lI5Q8/hY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ihy6COFHlIh2So8h9MCe4tUVMP7a4/WVq4zJDN0ZfFCNUP00hKvAO6uguLVLoi3WB SZcsfwLbK6OIEcOL/8K0eCF4tF2rb3w8aGZXz0Q3V+9gLH7FnTAuxdrLz+goZwj+Go HnANmcjMAcy9r7QebNy3FJ2p6GmUwHYqJMiHL9sg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Namjae Jeon , Sasha Levin Subject: [PATCH 6.18 0403/1005] ksmbd: protect private extended attributes Date: Wed, 4 Nov 2026 16:02:16 -0500 Message-ID: <20261104211055.365185630@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Namjae Jeon [ Upstream commit 4ea46ea602fc7055eee4b5b0e84f90f22da7f7e7 ] SMB clients can currently create an EA named NTACL because SMB EAs are mapped into the user namespace while the ksmbd security descriptor is stored as security.NTACL. Allowing the reserved logical name makes the server-private ACL metadata appear writable through the SMB EA API. Reject NTACL, DOSATTRIB, and DosStream-prefixed EA names without regard to case. Filter the same private names from EA query results so stale or externally-created user namespace attributes cannot be exposed. This fixes smb2.ea.acl_xattr when acl_xattr_name is configured as NTACL. Signed-off-by: Namjae Jeon Signed-off-by: Sasha Levin --- fs/smb/server/smb2pdu.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index c97f2a128651f..7909d1ce67937 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2378,6 +2378,22 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work) return err; } +static bool smb2_is_private_ea(const char *name, size_t name_len) +{ + if (name_len == SD_PREFIX_LEN && + !strncasecmp(name, SD_PREFIX, SD_PREFIX_LEN)) + return true; + if (name_len == DOS_ATTRIBUTE_PREFIX_LEN && + !strncasecmp(name, DOS_ATTRIBUTE_PREFIX, + DOS_ATTRIBUTE_PREFIX_LEN)) + return true; + if (name_len >= STREAM_PREFIX_LEN && + !strncasecmp(name, STREAM_PREFIX, STREAM_PREFIX_LEN)) + return true; + + return false; +} + /** * smb2_set_ea() - handler for setting extended attributes using set * info command @@ -2419,6 +2435,10 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, rc = -EINVAL; break; } + if (smb2_is_private_ea(eabuf->name, eabuf->EaNameLength)) { + rc = -EACCES; + break; + } memcpy(attr_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); memcpy(&attr_name[XATTR_USER_PREFIX_LEN], eabuf->name, @@ -4828,17 +4848,13 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp, if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) continue; - if (!strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, - STREAM_PREFIX_LEN)) - continue; - if (req->InputBufferLength && strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name, ea_req->EaNameLength)) continue; - if (!strncmp(&name[XATTR_USER_PREFIX_LEN], - DOS_ATTRIBUTE_PREFIX, DOS_ATTRIBUTE_PREFIX_LEN)) + if (smb2_is_private_ea(&name[XATTR_USER_PREFIX_LEN], + name_len - XATTR_USER_PREFIX_LEN)) continue; if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) -- 2.53.0