Re: [PATCH 3/5] cifs: Fix validation of SMB2_OP_QUERY_WSL_EA response size

[Pali Rohár]

On Sunday 08 June 2025 18:49:43 Paulo Alcantara wrote:
> Pali Rohár <pali@xxxxxxxxxx> writes:
> 
> > Currently the SMB2_OP_QUERY_WSL_EA checks that response buffer has at least
> > size SMB2_WSL_MIN_QUERY_EA_RESP_SIZE and maximally it is
> > SMB2_WSL_MAX_QUERY_EA_RESP_SIZE.
> >
> > Constant SMB2_WSL_MIN_QUERY_EA_RESP_SIZE is defined wrongly because it
> > expects that the there are at least 3 EAs. But WSL subsystem has only one
> > mandatory EA: $LXMOD. So fix the SMB2_WSL_MIN_QUERY_EA_RESP_SIZE to be size
> > of the structure of one EA.
> >
> > Relax also SMB2_WSL_MAX_QUERY_EA_RESP_SIZE, calculate maximum size from the
> > size of the largest EA which is 8 bytes for $LXDEV.
> >
> > This change allows to recognize WSL CHR and BLK reparse points which have
> > only $LXMOD and $LXDEV EAs (no $LXUID or $LXGID). WSL subsystem recognize
> > such reparse points too.
> >
> > Fixes: ea41367b2a60 ("smb: client: introduce SMB2_OP_QUERY_WSL_EA")
> > Signed-off-by: Pali Rohár <pali@xxxxxxxxxx>
> > ---
> >  fs/smb/client/smb2pdu.h | 19 +++++++++----------
> >  1 file changed, 9 insertions(+), 10 deletions(-)
> 
> If we're querying all those EAs and the file has only $LXMOD, wouldn't
> the server return empty EAs except for $LXMOD?

We are using FILE_FULL_EA_INFORMATION for querying EAs, which means that
always all stored EAs are returned. It is not 4 calls (one by one), but
rather one call to return everything at once.

Windows server in this case returns just one EA in its response: $LXMOD EA.
And SMB2_WSL_MIN_QUERY_EA_RESP_SIZE specifies that at least 3 EAs must
be returned, otherwise check_wsl_eas() throws error and do not try to
parse response.