summaryrefslogtreecommitdiff
path: root/scripts/basic
diff options
context:
space:
mode:
authorPaulo Alcantara <pc@manguebit.org>2026-09-06 14:40:39 -0300
committerPaulo Alcantara <pc@manguebit.org>2026-09-08 11:29:57 -0300
commitda6e25842431982d5a53cf00d925b98c690f4467 (patch)
tree56a9907464b72921acf0bc9eaa2b67b71ce73e84 /scripts/basic
parentcd2b2b57921d4caa7875e83198bb2aa71254328b (diff)
downloadlinux-da6e25842431982d5a53cf00d925b98c690f4467.tar.gz
linux-da6e25842431982d5a53cf00d925b98c690f4467.zip
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to request_key() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon. Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected. Closes: https://sashiko.dev/#/patchset/20260906172005.627163-1-pc%40manguebit.org Closes: https://sashiko.dev/#/patchset/20260906181540.647469-1-pc%40manguebit.org Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Shyam Prasad N <sprasad@microsoft.com> Cc: Tom Talpey <tom@talpey.com> Cc: Bharath SM <bharathsm@microsoft.com> Cc: stable@vger.kernel.org
Diffstat (limited to 'scripts/basic')
0 files changed, 0 insertions, 0 deletions