From: Frank Sorenson <sorenson@redhat.com>
To: Zihan Xi <zihanx@nebusec.ai>, pc@manguebit.org
Cc: linkinjeon@kernel.org, linux-cifs@vger.kernel.org,
samba-technical@lists.samba.org
Subject: Re: [PATCH v4 0/6] smb: client: fix create context out-of-bounds reads
Date: Mon, 21 Sep 2026 10:10:07 -0500 [thread overview]
Message-ID: <199e41b7-e739-417a-9c23-f812dc56e7a9@redhat.com> (raw)
In-Reply-To: <cover.1789478666.git.zihanx@nebusec.ai>
On 9/16/26 10:29 AM, Zihan Xi wrote:
> Hi Linux kernel maintainers,
>
> We found and validated an issue in fs/smb/client/smb2pdu.c. A malicious
> SMB server can send a malformed SMB2 CREATE response to a CIFS client and
> trigger an out-of-bounds read. We validated this with an Impacket server on
> the QEMU host and a root CIFS client in the guest; CIFS does not set
> FS_USERNS_MOUNT, so the mount must run as root. For valid SMB responses,
> the series preserves existing request handling. No impact was observed in
> the tested CIFS mount/read path; a full filesystem regression suite was not
> run.
I ran xfstests comparing cifs-next (7.3-rc2+) with and without this patchset,
and I don't see any additional failures due with these patches:
tested against:
samba: v3.1.1, v3.1.1+sign, v3.1.1+seal, v2.1, v2.1+sign, v1
Windows Server 2022: v3.1.1, v3.1.1+sign, v3.1.1+seal
I have not tested using the POC... just for regressions.
Tested-by: Frank Sorenson <sorenson@redhat.com>
Frank
--
Frank Sorenson
sorenson@redhat.com
Principal Software Maintenance Engineer, filesystems
Red Hat
next prev parent reply other threads:[~2026-09-21 15:10 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-16 15:29 [PATCH v4 0/6] smb: client: fix create context out-of-bounds reads Zihan Xi
2026-09-16 15:29 ` [PATCH v4 1/6] " Zihan Xi
2026-09-16 15:29 ` [PATCH v4 2/6] smb: client: validate POSIX create context length Zihan Xi
2026-09-16 15:29 ` [PATCH v4 3/6] smb: client: close handle after create-context parsing failure Zihan Xi
2026-09-16 15:29 ` [PATCH v4 4/6] smb: client: clean up failed cached directory opens Zihan Xi
2026-09-16 15:29 ` [PATCH v4 5/6] smb: client: close completed creates on compound wait errors Zihan Xi
2026-09-16 15:29 ` [PATCH v4 6/6] smb: client: preserve create-context parsing errors Zihan Xi
2026-09-21 15:10 ` Frank Sorenson [this message]
2026-09-23 1:09 ` [PATCH v4 0/6] smb: client: fix create context out-of-bounds reads Paulo Alcantara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=199e41b7-e739-417a-9c23-f812dc56e7a9@redhat.com \
--to=sorenson@redhat.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=pc@manguebit.org \
--cc=samba-technical@lists.samba.org \
--cc=zihanx@nebusec.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox