From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx1.manguebit.org (mx1.manguebit.org [143.255.12.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D93C2BD00C; Mon, 14 Sep 2026 01:10:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=143.255.12.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789348260; cv=none; b=piJjegBkeRPOb+ceTl85yUyUTLUzNBBhwS/nyuhtmypW3UcAm04G9idRMnhGc9ewCrKytnsJkX9VmlZ/tQszPuGlcWt2jH58ONnFGl2lLWB0ZIJQLuiTS9S1GwmG+Cx3SCK0tK+uAJsAZ5flyerJcmQKIuTFWHkLRdiHp6huaEs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789348260; c=relaxed/simple; bh=B0i56RUFfvYfjE7+JYj2NPdCwqVDUqvzGWeABnFeUoA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Vsq/47bB3piiU5lEkMoJGsSKPY1pUTQi+nuTVsTsakWsqtr9bZS8vmbpMU5qEMr1bcbVl4tS/tP4KzYWWNyk1I0lVWG8+qJMjp+UUIglZ6Jd7kRCMw7Vv5lfzap5MwESZQUU3tXKvLzTKZBhmui3LbEaYST4fOPxHClsWl+E+3k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=manguebit.org; spf=pass smtp.mailfrom=manguebit.org; dkim=pass (2048-bit key) header.d=manguebit.org header.i=@manguebit.org header.b=RfaL8rbV; arc=none smtp.client-ip=143.255.12.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=manguebit.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=manguebit.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=manguebit.org header.i=@manguebit.org header.b="RfaL8rbV" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=manguebit.org; s=dkim; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Content-Type:Reply-To: Content-ID:Content-Description; bh=vvogwQEyF91SCR+49Sgt22LmU7mWdMDmhjfhbp8SKu4=; b=RfaL8rbVrGwBhdPUpBj5sfFfNh 1BP9FKAywqPwCq7b39C7A2LLgf1xQsnCEKwhXoeEKUNfdNdCkGGQk7ORQp7RZ9aZdGvIhbt2l4y5H f0hnxVmvW48L3IIOr4LQzOE6aPWLNAODx375SM6hulYUVGtkR1tbWOjvfAPfa/RSL8VhjqDXqjLGv cEXZfWBUb7k22tEmsb2CErl13zGTeYLyYZJxUL96xJhPkaBFCJbRElwXb35eNSpcQQhOTaznoUZC3 Xa6p44K2JMYDmn0Hzu+r3EW3Hgg7OstSutLFk/JtUWCIQFL0knuYUxQ6miAF9w0FeRGQoDeyftLek I3nWjXdA==; Received: from pc by mx1.manguebit.org with local (Exim 4.99.5) id 1x5vDh-00000001M8H-0xNO; Sun, 13 Sep 2026 22:10:53 -0300 From: Paulo Alcantara To: linux-cifs@vger.kernel.org Cc: David Howells , Tom Talpey , Shyam Prasad N , Ronnie Sahlberg , Bharath SM , Namjae Jeon , stable@vger.kernel.org Subject: [PATCH 2/2] smb: client: fix fattr leaking on wsl_to_fattr() failure Date: Sun, 13 Sep 2026 22:10:52 -0300 Message-ID: <20260914011052.809774-2-pc@manguebit.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260914011052.809774-1-pc@manguebit.org> References: <20260914011052.809774-1-pc@manguebit.org> Precedence: bulk X-Mailing-List: linux-cifs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit wsl_to_fattr() mutates fattr fields as it parses each WSL EA. If validation later fails, the function returns false with partially mutated fattr fields that callers do not reset. Fix this by parsing into local variables and only committing them to fattr on success. Closes: https://sashiko.dev/#/patchset/20260906200517.725015-1-pc%40manguebit.org Fixes: 78e26bec4d6d ("smb: client: parse uid, gid, mode and dev from WSL reparse points") Signed-off-by: Paulo Alcantara Cc: David Howells Cc: Tom Talpey Cc: Shyam Prasad N Cc: Ronnie Sahlberg Cc: Bharath SM Cc: Namjae Jeon Cc: stable@vger.kernel.org --- fs/smb/client/reparse.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c index 6ac69f4d391a..3a27773186ae 100644 --- a/fs/smb/client/reparse.c +++ b/fs/smb/client/reparse.c @@ -1149,29 +1149,30 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data, u32 tag, struct cifs_fattr *fattr) { unsigned int sbflags = cifs_sb_flags(cifs_sb); + kuid_t uid = cifs_sb->ctx->linux_uid; + kgid_t gid = cifs_sb->ctx->linux_gid; struct smb2_file_full_ea_info *ea; bool have_xattr_dev = false; + dev_t rdev = 0; + umode_t mode; u32 next = 0; - fattr->cf_uid = cifs_sb->ctx->linux_uid; - fattr->cf_gid = cifs_sb->ctx->linux_gid; - - fattr->cf_mode &= ~S_IFMT; + mode = fattr->cf_mode & ~S_IFMT; switch (tag) { case IO_REPARSE_TAG_LX_SYMLINK: - fattr->cf_mode |= S_IFLNK; + mode |= S_IFLNK; break; case IO_REPARSE_TAG_LX_FIFO: - fattr->cf_mode |= S_IFIFO; + mode |= S_IFIFO; break; case IO_REPARSE_TAG_AF_UNIX: - fattr->cf_mode |= S_IFSOCK; + mode |= S_IFSOCK; break; case IO_REPARSE_TAG_LX_CHR: - fattr->cf_mode |= S_IFCHR; + mode |= S_IFCHR; break; case IO_REPARSE_TAG_LX_BLK: - fattr->cf_mode |= S_IFBLK; + mode |= S_IFBLK; break; } @@ -1195,26 +1196,29 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data, if (!strncmp(name, SMB2_WSL_XATTR_UID, nlen)) { if (!(sbflags & CIFS_MOUNT_OVERR_UID)) - fattr->cf_uid = wsl_make_kuid(cifs_sb, v); + uid = wsl_make_kuid(cifs_sb, v); } else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen)) { if (!(sbflags & CIFS_MOUNT_OVERR_GID)) - fattr->cf_gid = wsl_make_kgid(cifs_sb, v); + gid = wsl_make_kgid(cifs_sb, v); } else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) { /* File type in reparse point tag and in xattr mode must match. */ - if (S_DT(fattr->cf_mode) != S_DT(get_unaligned_le32(v))) + if (S_DT(mode) != S_DT(get_unaligned_le32(v))) return false; - fattr->cf_mode = (umode_t)get_unaligned_le32(v); + mode = get_unaligned_le32(v); } else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) { - fattr->cf_rdev = reparse_mkdev(v); + rdev = reparse_mkdev(v); have_xattr_dev = true; } } while (next); out: - /* Major and minor numbers for char and block devices are mandatory. */ if (!have_xattr_dev && (tag == IO_REPARSE_TAG_LX_CHR || tag == IO_REPARSE_TAG_LX_BLK)) return false; + fattr->cf_uid = uid; + fattr->cf_gid = gid; + fattr->cf_mode = mode; + fattr->cf_rdev = rdev; return true; } -- 2.55.0