| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1bde0a162a5905828806e0993ba9e524@manguebit.com>
Date: Sun, 08 Jun 2025 18:49:43 -0300
From: Paulo Alcantara <pc@...guebit.com>
To: Pali Rohár <pali@...nel.org>, Steve French
<sfrench@...ba.org>
Cc: linux-cifs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/5] cifs: Fix validation of SMB2_OP_QUERY_WSL_EA
response size
Pali Rohár <pali@...nel.org> writes:
> Currently the SMB2_OP_QUERY_WSL_EA checks that response buffer has at least
> size SMB2_WSL_MIN_QUERY_EA_RESP_SIZE and maximally it is
> SMB2_WSL_MAX_QUERY_EA_RESP_SIZE.
>
> Constant SMB2_WSL_MIN_QUERY_EA_RESP_SIZE is defined wrongly because it
> expects that the there are at least 3 EAs. But WSL subsystem has only one
> mandatory EA: $LXMOD. So fix the SMB2_WSL_MIN_QUERY_EA_RESP_SIZE to be size
> of the structure of one EA.
>
> Relax also SMB2_WSL_MAX_QUERY_EA_RESP_SIZE, calculate maximum size from the
> size of the largest EA which is 8 bytes for $LXDEV.
>
> This change allows to recognize WSL CHR and BLK reparse points which have
> only $LXMOD and $LXDEV EAs (no $LXUID or $LXGID). WSL subsystem recognize
> such reparse points too.
>
> Fixes: ea41367b2a60 ("smb: client: introduce SMB2_OP_QUERY_WSL_EA")
> Signed-off-by: Pali Rohár <pali@...nel.org>
> ---
> fs/smb/client/smb2pdu.h | 19 +++++++++----------
> 1 file changed, 9 insertions(+), 10 deletions(-)
If we're querying all those EAs and the file has only $LXMOD, wouldn't
the server return empty EAs except for $LXMOD?
Powered by blists - more mailing lists