Andrew Lukoshko
f6916a8ae1
Add the RHEL 211.19.1..211.20.1 backports (1245-1287) from centos-stream-10 and upstream, on top of 211.18.1, plus the dpll RHEL kABI adaptation (1287). RHEL now ships the smb cifs.spnego fix too; the existing ahead-fix 1105 is byte-identical, so RHEL's redundant copy is omitted. Bump to 211.20.1.
58 lines
2.3 KiB
Diff
58 lines
2.3 KiB
Diff
From f1579c843ecda9218102033597e2bafe1ce8ec74 Mon Sep 17 00:00:00 2001
|
|
From: Paulo Alcantara <paalcant@redhat.com>
|
|
Date: Sun, 10 May 2026 18:08:12 -0300
|
|
Subject: [PATCH] smb: client: use kzalloc to zero-initialize security
|
|
descriptor buffer
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-172829
|
|
|
|
commit 5e489c6c47a2ac15edbaca153b9348e42c1eacab
|
|
Author: Bjoern Doebel <doebel@amazon.de>
|
|
Date: Thu Apr 30 08:57:17 2026 +0000
|
|
|
|
smb: client: use kzalloc to zero-initialize security descriptor buffer
|
|
|
|
Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces
|
|
to le16") split struct smb_acl's __le32 num_aces field into __le16
|
|
num_aces and __le16 reserved. The reserved field corresponds to Sbz2
|
|
in the MS-DTYP ACL wire format, which must be zero [1].
|
|
|
|
When building an ACL descriptor in build_sec_desc(), we are using a
|
|
kmalloc()'ed descriptor buffer and writing the fields explicitly using
|
|
le16() writes now. This never writes to the 2 byte reserved field,
|
|
leaving it as uninitialized heap data.
|
|
|
|
When the reserved field happens to contain non-zero slab garbage,
|
|
Samba rejects the security descriptor with "ndr_pull_security_descriptor
|
|
failed: Range Error", causing chmod to fail with EINVAL.
|
|
|
|
Change kmalloc() to kzalloc() to ensure the entire buffer is
|
|
zero-initialized.
|
|
|
|
Fixes: 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16")
|
|
Cc: stable@vger.kernel.org
|
|
|
|
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
|
|
Assisted-by: Kiro:claude-opus-4.6
|
|
[1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428
|
|
Signed-off-by: Steve French <stfrench@microsoft.com>
|
|
|
|
Signed-off-by: Paulo Alcantara <paalcant@redhat.com>
|
|
|
|
diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c
|
|
index 717a40fa84aa..03bad2885e96 100644
|
|
--- a/fs/smb/client/cifsacl.c
|
|
+++ b/fs/smb/client/cifsacl.c
|
|
@@ -1741,7 +1741,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,
|
|
* descriptor parameters, and security descriptor itself
|
|
*/
|
|
nsecdesclen = max_t(u32, nsecdesclen, DEFAULT_SEC_DESC_LEN);
|
|
- pnntsd = kmalloc(nsecdesclen, GFP_KERNEL);
|
|
+ pnntsd = kzalloc(nsecdesclen, GFP_KERNEL);
|
|
if (!pnntsd) {
|
|
kfree(pntsd);
|
|
cifs_put_tlink(tlink);
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|