kernel/git/next/linux-next.git/fs/smb/server, branch master

ksmbd: print IPv6 client addresses correctly in procfs

2026-09-14T11:14:42+00:00

conn->inet_addr and conn->inet6_addr share a union, and three procfs printers choose between them by testing whether inet_addr is zero. For an IPv6 peer that field aliases the first four bytes of the address, which are zero only for :: prefixed addresses, so a client with a global IPv6 address takes the IPv4 branch and is listed from those four bytes. A client at 2001:db8::1 is listed as 32.1.13.184. IPv4 mapped addresses begin with zero bytes, so the listing is correct until a native IPv6 client connects. Record the address family where the address is stored and select on that, in the client listing and in both session listings. Fixes: fe4dc5987d7d ("ksmbd: expose connection runtime state in procfs") Signed-off-by: Gael Blivet Assisted-by: Claude:claude-opus-5 Signed-off-by: Namjae Jeon

ksmbd: fix AFP_AfpInfo header fields in synthesized xattr

2026-09-14T11:14:41+00:00

smb2_set_stream_name_xattr() synthesizes a 60-byte AFP_AfpInfo xattr when a client opens a nonexistent one on a Time Machine share, so the probe is answered instead of failing with -EBADF. Its header does not match what clients write: ksmbd uses 0x00051607 and 0x00020000 for the first two fields and leaves the third zero. The user.DosStream.AFP_AfpInfo:$DATA xattr a macOS client writes begins: 00000000: 4146 5000 0000 0100 0000 0000 0000 0080 AFP............. Write those sixteen bytes: the signature, the version at offset 4 and the backup time at offset 12. The 60-byte length is already correct and the rest stays zeroed: a zero type and creator lets the client use the file extension for icon and type detection. Fixes: eaff8e924f60 ("ksmbd: synthesize empty AFP_AfpInfo xattr on first probe") Signed-off-by: Gael Blivet Assisted-by: Claude:claude-opus-5 Signed-off-by: Namjae Jeon

ksmbd: look up stream size by exact xattr name

2026-09-14T11:14:41+00:00

get_file_stream_info() walks the xattr list from a single ksmbd_vfs_listxattr() and sizes each stream it finds with ksmbd_vfs_casexattr_len(), which matches with strncasecmp(). Linux xattr names are case-sensitive, so two streams differing only in case report each other's size. The loop already holds the exact name, so query it directly with ksmbd_vfs_xattr_len(), which is what casexattr_len() calls once its search succeeds. Make it non-static and declare it in vfs.h, and drop the comment above it, which describes a different bug and no longer matches the code. This also drops a full listing per stream: casexattr_len() runs its own listxattr on every call, so enumerating a file with N xattrs cost N listings instead of one. Fixes: 689f1eb3719d ("ksmbd: report actual xattr value length in stream enumeration") Signed-off-by: Gael Blivet Assisted-by: Claude:claude-opus-5 Signed-off-by: Namjae Jeon

ksmbd: copy stream content when renaming to a new stream name

2026-09-14T11:14:41+00:00

smb2_rename() creates the target stream with ksmbd_vfs_setxattr(..., NULL, 0, ...), so the source stream's content is not carried over and renaming a named stream produces a zero-length stream. Read the source stream and write it under the new name. The lookup is case-insensitive because smb2_set_stream_name_xattr() stores fp->stream.name with the client's casing, which need not be the casing on disk. A rename to the stream the handle already refers to does nothing; that comparison is case-insensitive too, since every lookup in this path is. A read failure now fails the rename instead of creating an empty target, and a write failure reports its own errno rather than -EINVAL, since writing a value can fail where writing an empty one could not. Initialize s_type, which parse_stream_name() assigns only when the name carries an explicit stream type and which selects the target xattr name. parse_stream_name() leaves the stream name empty when the stream part is, as in "::$DATA" or ":", returning NULL for the first spelling and "" for the second. Return without creating an xattr in either case, after the base name check so that a base ending in '/' is covered too. These previously created xattrs named "(null)" and "". The source xattr is left in place and fp->stream.name still refers to it, as before this change: readers of that pointer take no lock, so it cannot be swapped here. Signed-off-by: Gael Blivet Assisted-by: Claude:claude-opus-5 Signed-off-by: Namjae Jeon

ksmbd: test maximal-access DACL walk boundary

2026-09-14T11:14:40+00:00

Add a maximal-access variant of the smb_check_perm_dacl() boundary test. The in-boundary ACE grants read access, while a trailing ACE beyond the declared DACL size grants write access. Verify that maximal-access calculation includes the in-boundary permission and ignores the trailing permission. Suggested-by: ChenXiaoSong Signed-off-by: Hang Nan Reviewed-by: ChenXiaoSong Signed-off-by: Namjae Jeon

ksmbd: test smb_check_perm_dacl() DACL walk boundary

2026-09-14T11:14:40+00:00

Drive smb_check_perm_dacl() through ksmbd's NTACL xattr path with a crafted descriptor whose second ACE is beyond the declared DACL size. Verify that the out-of-boundary ACE is not selected and access remains denied. Suggested-by: ChenXiaoSong Signed-off-by: Hang Nan Reviewed-by: ChenXiaoSong Signed-off-by: Namjae Jeon

ksmbd: add KUnit test for the DACL walk boundary

2026-09-14T11:14:39+00:00

smb_check_perm_dacl() must stop walking ACEs at the DACL declared size instead of using the enclosing security descriptor length. Add the ksmbd KUnit test configuration and a semantic harness that verifies a crafted access-granting ACE beyond the declared DACL size is ignored. Suggested-by: ChenXiaoSong Suggested-by: Namjae Jeon Signed-off-by: Hang Nan Reviewed-by: ChenXiaoSong Signed-off-by: Namjae Jeon

ksmbd: refactor smb2_notify() to a blocking wait

2026-09-14T11:14:39+00:00

The previous design registered a synthetic work struct (in_work) directly on conn->async_requests and deferred the response to a workqueue -- a bespoke async/cancel implementation duplicating what setup_async_work(), release_async_work(), and smb2_send_interim_resp() already provide for smb2_lock()'s pending byte-range lock. Replace it with that same pattern: setup_async_work() on the calling work itself, registered on fp->blocked_works, woken by cancel or by the handle closing via the existing set_close_state_blocked_works(). This removes the synthetic work struct, the notify_pendings list and its close-time drain, and the deferred workqueue send, leaving smb2_notify() sharing the same async/cancel machinery as smb2_lock() instead of its own separate copy. The worker now blocks on ksmbd_wq for as long as the watch stays open, instead of returning immediately. This also makes the skeleton ready for a future event-delivery implementation on the same blocking wait. Suggested-by: ChenXiaoSong Signed-off-by: Gael Blivet Assisted-by: Claude:claude-sonnet-5 Tested-by: ChenXiaoSong Reviewed-by: ChenXiaoSong Signed-off-by: Namjae Jeon

smb/server: support compound fid in notify requests

2026-09-14T11:14:38+00:00

A Windows client can send a compound request containing: Create Request, File: ; Notify Request The Notify Request uses FFFF...FFFF as the compound FID. Signed-off-by: ChenXiaoSong Signed-off-by: Namjae Jeon

ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()

2026-09-14T11:14:38+00:00

When the large dacl_offset is provided, dacl_offset + sizeof(struct smb_acl) overflows on 32-bit builds and the check is passed, Which makes le16_to_cpu(ppdacl_ptr->size) read out-of-bounds. This only happens for dacl_offset in range [0xFFFFFFF8, 0xFFFFFFFF]. So the oob read is max 8 bytes preceding the allocated ppntsd. unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset); int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset; if (!dacl_offset || (dacl_offset + sizeof(struct smb_acl) > ppntsd_size)) goto out; Commit beff0bc9d69b ("ksmbd: fix overflow in dacloffset bounds check") fixes similar checks in other functions. But leaves this one out, because it is only valid for 32-bit builds. Reproduced on 32-bit ARM with KASAN, by a client sending SMB2 SET_INFO(SEC) with dacloffset=0xfffffff8, then QUERY_INFO(SEC) on the same file: BUG: KASAN: slab-out-of-bounds in build_sec_desc (fs/smb/server/smbacl.c:1105) Read of size 2 at addr c2a273fa by task kworker/1:1/35 CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Not tainted 7.3.0-rc2+ #5 Workqueue: ksmbd-io handle_ksmbd_work Call trace: kasan_check_range from build_sec_desc (fs/smb/server/smbacl.c:1105) build_sec_desc from smb2_query_info (fs/smb/server/smb2pdu.c:7676) smb2_query_info from handle_ksmbd_work (fs/smb/server/server.c:160) handle_ksmbd_work from process_one_work (kernel/workqueue.c:3401) process_one_work from worker_thread (kernel/workqueue.c:3473) worker_thread from kthread (kernel/kthread.c:436) Add overflow check. Fixes: 8f0541186e9a ("ksmbd: fix heap-based overflow in set_ntacl_dacl()") Cc: stable@vger.kernel.org Assisted-by: LLM claude Tested-by: Xiang Mei Signed-off-by: Giorgi Kobakhia Signed-off-by: Namjae Jeon