From: Paulo Alcantara <pc@manguebit.org>
To: linux-cifs@vger.kernel.org
Cc: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>,
Pali Rohar <pali@kernel.org>, Namjae Jeon <linkinjeon@kernel.org>,
Ronnie Sahlberg <ronniesahlberg@gmail.com>,
Shyam Prasad N <sprasad@microsoft.com>,
Tom Talpey <tom@talpey.com>, Bharath SM <bharathsm@microsoft.com>,
stable@vger.kernel.org
Subject: Re: [PATCH] smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
Date: Thu, 10 Sep 2026 11:14:34 -0300 [thread overview]
Message-ID: <d99c2b25ef6a34a2a9301e19f5f8fe0d@manguebit.org> (raw)
In-Reply-To: <20260909230748.1226168-1-pc@manguebit.org>
Paulo Alcantara <pc@manguebit.org> writes:
> When parsing a share-root relative native symlink, memcpy copies
> smb_target+1 (skipping the leading separator) but uses
> strlen(smb_target)+1 as the length, reading one byte past the
> allocated buffer.
>
> This fixes the following KASAN splat when accessing an SMB symlink
> with a target of '\a\b':
>
> BUG: KASAN: slab-out-of-bounds in smb2_parse_native_symlink+0x4f5/0xca0
> Read of size 5 at addr ffff88800878fe21 by task netfsfuzz-execu/1
> CPU: 1 UID: 0 PID: 1 Comm: netfsfuzz-execu Tainted: G N
> 7.2.0-11943-g2709dd5ae32f-dirty #1 PREEMPT(lazy)
> Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix,
> 1996)
> Call Trace:
> <TASK>
> dump_stack_lvl+0x7b/0xa0
> print_report+0xd0/0x630
> kasan_report+0xe5/0x120
> kasan_check_range+0x105/0x1b0
> __asan_memcpy+0x23/0x60
> smb2_parse_native_symlink+0x4f5/0xca0
> parse_reparse_point+0x68a/0x1530
> reparse_info_to_fattr+0x752/0xa20
> cifs_get_fattr+0x873/0x15b0
> cifs_get_inode_info+0xc0/0x310
> cifs_lookup+0x308/0xa70
> __lookup_slow+0x122/0x2b0
> lookup_slow+0x50/0x70
> path_lookupat+0x525/0xaf0
> filename_lookup+0x1f2/0x550
> vfs_statx+0xd1/0x1a0
> vfs_fstatat+0x65/0xc0
> __do_sys_newfstatat+0x9a/0x120
> do_syscall_64+0xdd/0x4a0
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> ...
Applied.
prev parent reply other threads:[~2026-09-10 14:14 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-09 23:07 [PATCH] smb: client: fix one-byte OOB read in smb2_parse_native_symlink() Paulo Alcantara
2026-09-10 0:03 ` Namjae Jeon
2026-09-10 0:27 ` Pali Rohár
2026-09-10 14:14 ` Paulo Alcantara [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d99c2b25ef6a34a2a9301e19f5f8fe0d@manguebit.org \
--to=pc@manguebit.org \
--cc=bharathsm@microsoft.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=pali@kernel.org \
--cc=ronniesahlberg@gmail.com \
--cc=sprasad@microsoft.com \
--cc=stable@vger.kernel.org \
--cc=tom@talpey.com \
--cc=yuanfuxie@stu.pku.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox