linux-kernel - Re: [PATCH 3/5] cifs: Fix validation of SMB2_OP_QUERY_WSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <17c70afea9476e5a2ebb0ed37ea780ca@manguebit.com>
Date: Sun, 08 Jun 2025 20:10:24 -0300
From: Paulo Alcantara <pc@...guebit.com>
To: Pali Rohár <pali@...nel.org>
Cc: Steve French <sfrench@...ba.org>, linux-cifs@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/5] cifs: Fix validation of SMB2_OP_QUERY_WSL_EA
 response size

Pali Rohár <pali@...nel.org> writes:

> On Sunday 08 June 2025 18:49:43 Paulo Alcantara wrote:
>> Pali Rohár <pali@...nel.org> writes:
>> 
>> If we're querying all those EAs and the file has only $LXMOD, wouldn't
>> the server return empty EAs except for $LXMOD?
>
> We are using FILE_FULL_EA_INFORMATION for querying EAs, which means that
> always all stored EAs are returned. It is not 4 calls (one by one), but
> rather one call to return everything at once.

Yes.

> Windows server in this case returns just one EA in its response: $LXMOD EA.
> And SMB2_WSL_MIN_QUERY_EA_RESP_SIZE specifies that at least 3 EAs must
> be returned, otherwise check_wsl_eas() throws error and do not try to
> parse response.

Can you share a trace of the server returning only a single EA in the
response when we query $LXUID, $LXGID, $LXMOD and $LXDEV?

What I mean is that we query all those EAs when we find reparse points
on non-POSIX mounts, and if the file doesn't have them, the server still
returns the EAs but with a zero smb2_file_full_ea_info::ea_value_len.
check_wsl_eas() skips the EA when is @vlen zero.