When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)
Unified · Split
| @@ -1837,11 +1837,13 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, · 1836 unmodified lines | |||
| 1837 | cifs_put_tlink(tlink); | 1837 | cifs_put_tlink(tlink); |
| 1838 | return rc; | 1838 | return rc; |
| 1839 | } | 1839 | } |
| 1840 | if (mode_from_sid) | 1840 | /* |
| 1841 | nsecdesclen += | 1841 | * Worst case: every ACE is rewritten with a new SID of |
| 1842 | le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace); | 1842 | * SID_MAX_SUB_AUTHORITIES sub-auths -> sizeof(smb_ace) each, |
| 1843 | else /* cifsacl */ | 1843 | * plus the smb_acl header replace_sids_and_copy_aces() emits. |
| 1844 | nsecdesclen += le16_to_cpu(dacl_ptr->size); | 1844 | */ |
| 1845 | nsecdesclen += sizeof(struct smb_acl) + | ||
| 1846 | le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace); | ||
| 1845 | } | 1847 | } |
| 1846 | } | 1848 | } |
| 1847 | 1849 | ||