linux-kernel - Re: [PATCH 3/5] cifs: Fix validation of SMB2_OP_QUERY_WSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250608221536.fdwxexewsntxs3em@pali>
Date: Mon, 9 Jun 2025 00:15:36 +0200
From: Pali Rohár <pali@...nel.org>
To: Paulo Alcantara <pc@...guebit.com>
Cc: Steve French <sfrench@...ba.org>, linux-cifs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/5] cifs: Fix validation of SMB2_OP_QUERY_WSL_EA
 response size

On Sunday 08 June 2025 18:49:43 Paulo Alcantara wrote:
> Pali Rohár <pali@...nel.org> writes:
> 
> > Currently the SMB2_OP_QUERY_WSL_EA checks that response buffer has at least
> > size SMB2_WSL_MIN_QUERY_EA_RESP_SIZE and maximally it is
> > SMB2_WSL_MAX_QUERY_EA_RESP_SIZE.
> >
> > Constant SMB2_WSL_MIN_QUERY_EA_RESP_SIZE is defined wrongly because it
> > expects that the there are at least 3 EAs. But WSL subsystem has only one
> > mandatory EA: $LXMOD. So fix the SMB2_WSL_MIN_QUERY_EA_RESP_SIZE to be size
> > of the structure of one EA.
> >
> > Relax also SMB2_WSL_MAX_QUERY_EA_RESP_SIZE, calculate maximum size from the
> > size of the largest EA which is 8 bytes for $LXDEV.
> >
> > This change allows to recognize WSL CHR and BLK reparse points which have
> > only $LXMOD and $LXDEV EAs (no $LXUID or $LXGID). WSL subsystem recognize
> > such reparse points too.
> >
> > Fixes: ea41367b2a60 ("smb: client: introduce SMB2_OP_QUERY_WSL_EA")
> > Signed-off-by: Pali Rohár <pali@...nel.org>
> > ---
> >  fs/smb/client/smb2pdu.h | 19 +++++++++----------
> >  1 file changed, 9 insertions(+), 10 deletions(-)
> 
> If we're querying all those EAs and the file has only $LXMOD, wouldn't
> the server return empty EAs except for $LXMOD?

We are using FILE_FULL_EA_INFORMATION for querying EAs, which means that
always all stored EAs are returned. It is not 4 calls (one by one), but
rather one call to return everything at once.

Windows server in this case returns just one EA in its response: $LXMOD EA.
And SMB2_WSL_MIN_QUERY_EA_RESP_SIZE specifies that at least 3 EAs must
be returned, otherwise check_wsl_eas() throws error and do not try to
parse response.