Cover Letter Detail
Show a cover letter.
GET /api/1.2/covers/2223489/?format=api
{ "id": 2223489, "url": "http://patchwork.ozlabs.org/api/1.2/covers/2223489/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-cifs-client/cover/20260415112501.116426-1-michael.bommarito@gmail.com/", "project": { "id": 12, "url": "http://patchwork.ozlabs.org/api/1.2/projects/12/?format=api", "name": "Linux CIFS Client", "link_name": "linux-cifs-client", "list_id": "linux-cifs.vger.kernel.org", "list_email": "linux-cifs@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260415112501.116426-1-michael.bommarito@gmail.com>", "list_archive_url": null, "date": "2026-04-15T11:24:59", "name": "[v2,0/2] ksmbd: harden ipc_validate_msg() and smb_check_perm_dacl()", "submitter": { "id": 93078, "url": "http://patchwork.ozlabs.org/api/1.2/people/93078/?format=api", "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com" }, "mbox": "http://patchwork.ozlabs.org/project/linux-cifs-client/cover/20260415112501.116426-1-michael.bommarito@gmail.com/mbox/", "series": [ { "id": 499975, "url": "http://patchwork.ozlabs.org/api/1.2/series/499975/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-cifs-client/list/?series=499975", "date": "2026-04-15T11:24:59", "name": "ksmbd: harden ipc_validate_msg() and smb_check_perm_dacl()", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/499975/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/covers/2223489/comments/", "headers": { "Return-Path": "\n <linux-cifs+bounces-10833-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-cifs@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=ZdKI6y89;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=linux-cifs+bounces-10833-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"ZdKI6y89\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.160.179", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwf2j2pMqz1yHM\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 15 Apr 2026 21:25:33 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id BBF86305DD3B\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 15 Apr 2026 11:25:22 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id B166237A488;\n\tWed, 15 Apr 2026 11:25:21 +0000 (UTC)", "from mail-qt1-f179.google.com (mail-qt1-f179.google.com\n [209.85.160.179])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B2B2378D8E\n\tfor <linux-cifs@vger.kernel.org>; Wed, 15 Apr 2026 11:25:20 +0000 (UTC)", "by mail-qt1-f179.google.com with SMTP id\n d75a77b69052e-506a6cf8242so50631161cf.1\n for <linux-cifs@vger.kernel.org>;\n Wed, 15 Apr 2026 04:25:20 -0700 (PDT)", "from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net.\n [68.48.65.54])\n by smtp.gmail.com with ESMTPSA id\n d75a77b69052e-50e1af9dc5fsm10621191cf.16.2026.04.15.04.25.17\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 15 Apr 2026 04:25:17 -0700 (PDT)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776252321; cv=none;\n b=qRwbyqRVtpD5gczKAhzQukjy1iFM2MkAODpls57T0dQomw5KoWZwcIxDgit/t2Lj08XTx90+rvfnAciL18S6lUwU8ATQ9zb8rbvDEV0qArZ/ALE5sfmeP0WnRrUI4HmFKhyhCGp7j3/XQxZrpB8h+3z++sRfimlQU9pgNLoNEe0=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776252321; c=relaxed/simple;\n\tbh=VQsTM+mzGxb1tEMnoq0cXierV1ZHH1kctt8ri+qeVbU=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=APi6VQpaEn94FRqFEHkXLCMNlJvSR+k3Rt7ZOub/hCVMxwH3BMOTMh68BpcwWKZ9YiKyuG6Db0Ei0rkFnswPp0KqgoKJdLHrv6IjVmeAuwEWxzBbeO6octreysEllgSFwS5HMj86g9onB5/Bl3gt7Opvu/vlxB/l1VZQYhkRkQo=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=ZdKI6y89; arc=none smtp.client-ip=209.85.160.179", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1776252319; x=1776857119;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=BJ6fVrO3ohxiKYcaHCxp2wzI9fHSCKIoqnFp5q+kMYA=;\n b=ZdKI6y89qzlqk+Fsg6F2qBDMkDLoq5M2jjacPi4sGcCKblCMHTRdt4+emp0uvuTCae\n MKWEY5iI3TMS48uBDiAdJH8UkKxMJRW29361TJL6BEKrXY9BvrUcPa7NSBhPxvexgWlb\n EmMpTIYoHudPdz4YLkxx1oDIQ0Iyq5BDhAMjEr73RaqD/5apnqRJIrDGlfqstFE3149X\n bapskrxzkZkl9idiA3fg4Oon0lWZ/py6ymFxhZTkwBpZv3/Rls1OcxXpJt443DS7Bg9k\n nama5G8ouKPOCjCLM8ZrklHycDSw1IPxizxc0wrQoYX5ycTmMKxO4rWF/Ah1kHriNViT\n 2BoQ==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776252319; x=1776857119;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=BJ6fVrO3ohxiKYcaHCxp2wzI9fHSCKIoqnFp5q+kMYA=;\n b=T1BS2atMnbffgGP9Bs8SHrkuFed2W0NrwR3VLDm1lFK9gCCE4PhTVyVcX1yNgsX3bl\n cpmBA/4UrVzgmKuNkvgvP3XDvyooY1396wbVZjrHNK803UPeDvpIPPE07JDX19UMhwHG\n 2WYlYc9feaKVFRMBKCN76HDv5svehY0LGeISw114yYbXThxzAcQHvWQ0qVGrpnKAmHhi\n 3B0vacxbZUccb5+UbhJWDsUoQNrfPKxpoFEkYJONlAqjn48Hdk787oePRac0+jpDirg2\n UfZ7iJn8WadCrLPhmKjUCWrLJvL/m684ctGhr2fe0yI6AJ+AxALfTXMcBdrxf4nXZcUZ\n GMGg==", "X-Gm-Message-State": "AOJu0YwoiywhGNAvgMGMij2MrdMfvUB/kTRu5G5h5EaZYaHOf2a6mvKT\n\tTDyub7CYJtmC7gSOxbufjPjfAzibvSyVj8+m+mzFLbpgG+XbG+qUhJj0/Qqedw==", "X-Gm-Gg": "AeBDiesIKwou1WLXiFDPjP6x66uvnOIzof3xYrlaT/Z2gg4OnwSv5ohBtiMGs9uGcKE\n\tAg4A+8g+vWb6Cm5IIB8ZUoLFUWjmhQ92fiye7HrcvaVd904ip9yw2zuDH56w7vgXrkO1JNu7NO7\n\t7B7/tZc7nz7MTKeCzQ2gDCqsuEDynxDPXupdPv3PbNDFpgUQ82AUNAuMdv3wPNZu+PNr03aqXXr\n\tmyBEPG6zaPwHeWqxRtJNtcJEfCDTrg9dNcir6LBtMmCp8ftXycBspaee/41+IbU0FJEaVIS3DGB\n\ts6RtO6u4iIPiLzX5fxtqqs6puBAbf7wnWyu6Gxela2YiHvVcHiqA5TzF37cBKz+ISpjsT4NuGy1\n\tr0awD4AFC/3Z+OIx/+wHQrYnJu5dzMm++Ij99xklxSG3CJ5uAdTwH9q75XEe2CRxEwLmgbXozyd\n\tFmE1h5EplZ+kmFGCJsgXKD1b6rdmOjUC+yClxtrYfT5vKWpDJrbXtK0r0ghsFrLBlkZ/EAz2XqS\n\t7TMzklD1UZwOwIR+1S0PQJeilFu9coK4gn9q4esV3FcqW9BWGTp9g==", "X-Received": "by 2002:ac8:7d11:0:b0:509:35d1:ca37 with SMTP id\n d75a77b69052e-50dd5aeef70mr330727511cf.16.1776252318729;\n Wed, 15 Apr 2026 04:25:18 -0700 (PDT)", "From": "Michael Bommarito <michael.bommarito@gmail.com>", "To": "linux-cifs@vger.kernel.org,\n\tNamjae Jeon <linkinjeon@kernel.org>,\n\tSteve French <smfrench@gmail.com>", "Cc": "Sergey Senozhatsky <senozhatsky@chromium.org>,\n\tTom Talpey <tom@talpey.com>,\n\tstable@vger.kernel.org", "Subject": "[PATCH v2 0/2] ksmbd: harden ipc_validate_msg() and\n smb_check_perm_dacl()", "Date": "Wed, 15 Apr 2026 07:24:59 -0400", "Message-ID": "<20260415112501.116426-1-michael.bommarito@gmail.com>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<20260414191533.1467353-1-michael.bommarito@gmail.com>", "References": "<20260414191533.1467353-1-michael.bommarito@gmail.com>\n <CAKYAXd9EBFBcy9bJ3=sJiYVYHAYjKYqOqD53UCJ8zWKXF0sAeg@mail.gmail.com>\n <CAKYAXd8B78Gde_7+Ph0cSL998k4qqs_okB0jky0m5h8i25_AGQ@mail.gmail.com>", "Precedence": "bulk", "X-Mailing-List": "linux-cifs@vger.kernel.org", "List-Id": "<linux-cifs.vger.kernel.org>", "List-Subscribe": "<mailto:linux-cifs+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-cifs+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "Two ksmbd hardening patches, respun from v1 [PATCH 0/3] per Namjae's\nreview.\n\nPatch 1 folds v1 1/3 and 2/3 into a single response-side validation\nchange in ipc_validate_msg().\n\nPatch 2 is v1 3/3 unchanged (minimum ACE size in\nsmb_check_perm_dacl()). Please let me know if there's anything\non this 2/2 you want to think through or change.\n\nChanges since v1\n----------------\n\nv1 -> v2:\n\n - 1/3 + 2/3 folded into a single patch (1/2) per Namjae.\n - Dropped the hard KSMBD_IPC_MAX_PAYLOAD (4096) cap on\n RPC_REQUEST and SHARE_CONFIG_REQUEST response paths. A 4096\n cap would regress NetShareEnumAll and other NDR enumerations\n on servers with many shares -- userspace ksmbd-tools grows\n the response buffer in 4096-byte chunks via g_try_realloc().\n Use check_add_overflow() instead so functional payload size\n is unconstrained but msg_sz cannot wrap unsigned int.\n [Namjae]\n - LOGIN_REQUEST_EXT keeps the [0, NGROUPS_MAX] bound (POSIX\n semantic limit, not an IPC transport cap). Moved the\n pr_err() into ipc_validate_msg() so the error is reported\n at the IPC boundary. [Namjae]\n - Removed the now-redundant ngroups check and pr_err() from\n ksmbd_alloc_user() in mgmt/user_config.c. Both call sites\n (ksmbd_login_user and the SPNEGO path in auth.c) reach\n ksmbd_alloc_user() through ksmbd_ipc_login_request_ext(),\n which now rejects negative ngroups at the IPC gate. [Namjae]\n - SPNEGO_AUTHEN_REQUEST left untouched: session_key_len and\n spnego_blob_len are both __u16 so their sum cannot wrap the\n unsigned int msg_sz. [Namjae ack]\n - 2/2 (smb_check_perm_dacl minimum ACE size) unchanged from\n v1 3/3 -- no review yet.\n\nThreading\n---------\n\nSent --in-reply-to v1 [PATCH 0/3] cover\n(Message-ID 20260414191533.1467353-1-michael.bommarito@gmail.com)\nso v2 lives under the v1 thread.\n\nMichael Bommarito (2):\n ksmbd: validate response sizes in ipc_validate_msg()\n ksmbd: require minimum ACE size in smb_check_perm_dacl()\n\n fs/smb/server/mgmt/user_config.c | 6 ------\n fs/smb/server/smbacl.c | 17 +++++++++++++----\n fs/smb/server/transport_ipc.c | 16 +++++++++++++---\n 3 files changed, 26 insertions(+), 13 deletions(-)\n\n--\n2.53.0" }