github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-10 12:28:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

smb: client: fix native SMB symlink traversal

Browse Source 
We've seen customers having shares mounted in paths like /??/C:/ or
/??/UNC/foo.example.com/share in order to get their native SMB
symlinks successfully followed from different mounts.

After commit 12b466eb52 ("cifs: Fix creating and resolving absolute NT-style symlinks"),
the client would then convert absolute paths from "/??/C:/" to "/mnt/c/"
by default.  The absolute paths would vary depending on the value of
symlinkroot= mount option.

Fix this by restoring old behavior of not trying to convert absolute
paths by default.  Only do this if symlinkroot= was _explicitly_ set.

Before patch:

  $ mount.cifs //w22-fs0/test2 /mnt/1 -o vers=3.1.1,username=xxx,password=yyy
  $ ls -l /mnt/1/symlink2
  lrwxr-xr-x 1 root root 15 Jun 20 14:22 /mnt/1/symlink2 -> /mnt/c/testfile
  $ mkdir -p /??/C:; echo foo > //??/C:/testfile
  $ cat /mnt/1/symlink2
  cat: /mnt/1/symlink2: No such file or directory

After patch:

  $ mount.cifs //w22-fs0/test2 /mnt/1 -o vers=3.1.1,username=xxx,password=yyy
  $ ls -l /mnt/1/symlink2
  lrwxr-xr-x 1 root root 15 Jun 20 14:22 /mnt/1/symlink2 -> '/??/C:/testfile'
  $ mkdir -p /??/C:; echo foo > //??/C:/testfile
  $ cat /mnt/1/symlink2
  foo

Cc: linux-cifs@vger.kernel.org
Reported-by: Pierguido Lambri <plambri@redhat.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Stefan Metzmacher <metze@samba.org>
Fixes: 12b466eb52 ("cifs: Fix creating and resolving absolute NT-style symlinks")
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Paulo Alcantara 2025-07-03 17:57:19 -03:00 committed by Steve French
parent 266b5d02e1
commit 3363da82e0
2 changed files with 20 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
fs/smb/client/fs_context.c
View File

@ -1824,10 +1824,14 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
cifs_errorf(fc, "symlinkroot mount options must be absolute path\n"); cifs_errorf(fc, "symlinkroot mount options must be absolute path\n");
goto cifs_parse_mount_err; goto cifs_parse_mount_err;
} }
kfree(ctx->symlinkroot); if (strnlen(param->string, PATH_MAX) == PATH_MAX) {
ctx->symlinkroot = kstrdup(param->string, GFP_KERNEL); cifs_errorf(fc, "symlinkroot path too long (max path length: %u)\n",
if (!ctx->symlinkroot) PATH_MAX - 1);
goto cifs_parse_mount_err; goto cifs_parse_mount_err;
}
kfree(ctx->symlinkroot);
ctx->symlinkroot = param->string;
param->string = NULL;
break; break;
} }
/* case Opt_ignore: - is ignored as expected ... */ /* case Opt_ignore: - is ignored as expected ... */
@ -1837,13 +1841,6 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
goto cifs_parse_mount_err; goto cifs_parse_mount_err;
} }
/*
* By default resolve all native absolute symlinks relative to "/mnt/".
* Same default has drvfs driver running in WSL for resolving SMB shares.
*/
if (!ctx->symlinkroot)
ctx->symlinkroot = kstrdup("/mnt/", GFP_KERNEL);
return 0; return 0;
cifs_parse_mount_err: cifs_parse_mount_err:

22
fs/smb/client/reparse.c
View File

@ -57,6 +57,7 @@ static int create_native_symlink(const unsigned int xid, struct inode *inode,
struct reparse_symlink_data_buffer *buf = NULL; struct reparse_symlink_data_buffer *buf = NULL;
struct cifs_open_info_data data = {}; struct cifs_open_info_data data = {};
struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
const char *symroot = cifs_sb->ctx->symlinkroot;
struct inode *new; struct inode *new;
struct kvec iov; struct kvec iov;
__le16 *path = NULL; __le16 *path = NULL;
@ -82,7 +83,8 @@ static int create_native_symlink(const unsigned int xid, struct inode *inode,
.symlink_target = symlink_target, .symlink_target = symlink_target,
}; };
if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) && symname[0] == '/') { if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) &&
symroot && symname[0] == '/') {
/* /*
* This is a request to create an absolute symlink on the server * This is a request to create an absolute symlink on the server
* which does not support POSIX paths, and expects symlink in * which does not support POSIX paths, and expects symlink in
@ -92,7 +94,7 @@ static int create_native_symlink(const unsigned int xid, struct inode *inode,
* ensure compatibility of this symlink stored in absolute form * ensure compatibility of this symlink stored in absolute form
* on the SMB server. * on the SMB server.
*/ */
if (!strstarts(symname, cifs_sb->ctx->symlinkroot)) { if (!strstarts(symname, symroot)) {
/* /*
* If the absolute Linux symlink target path is not * If the absolute Linux symlink target path is not
* inside "symlinkroot" location then there is no way * inside "symlinkroot" location then there is no way
@ -101,12 +103,12 @@ static int create_native_symlink(const unsigned int xid, struct inode *inode,
cifs_dbg(VFS, cifs_dbg(VFS,
"absolute symlink '%s' cannot be converted to NT format " "absolute symlink '%s' cannot be converted to NT format "
"because it is outside of symlinkroot='%s'\n", "because it is outside of symlinkroot='%s'\n",
symname, cifs_sb->ctx->symlinkroot); symname, symroot);
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
len = strlen(cifs_sb->ctx->symlinkroot); len = strlen(symroot);
if (cifs_sb->ctx->symlinkroot[len-1] != '/') if (symroot[len - 1] != '/')
len++; len++;
if (symname[len] >= 'a' && symname[len] <= 'z' && if (symname[len] >= 'a' && symname[len] <= 'z' &&
(symname[len+1] == '/' || symname[len+1] == '\0')) { (symname[len+1] == '/' || symname[len+1] == '\0')) {
@ -782,6 +784,7 @@ int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len,
const char *full_path, const char *full_path,
struct cifs_sb_info *cifs_sb) struct cifs_sb_info *cifs_sb)
{ {
const char *symroot = cifs_sb->ctx->symlinkroot;
char sep = CIFS_DIR_SEP(cifs_sb); char sep = CIFS_DIR_SEP(cifs_sb);
char *linux_target = NULL; char *linux_target = NULL;
char *smb_target = NULL; char *smb_target = NULL;
@ -815,7 +818,8 @@ int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len,
goto out; goto out;
} }
if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) && !relative) { if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) &&
symroot && !relative) {
/* /*
* This is an absolute symlink from the server which does not * This is an absolute symlink from the server which does not
* support POSIX paths, so the symlink is in NT-style path. * support POSIX paths, so the symlink is in NT-style path.
@ -907,15 +911,15 @@ int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len,
} }
abs_path_len = strlen(abs_path)+1; abs_path_len = strlen(abs_path)+1;
symlinkroot_len = strlen(cifs_sb->ctx->symlinkroot); symlinkroot_len = strlen(symroot);
if (cifs_sb->ctx->symlinkroot[symlinkroot_len-1] == '/') if (symroot[symlinkroot_len - 1] == '/')
symlinkroot_len--; symlinkroot_len--;
linux_target = kmalloc(symlinkroot_len + 1 + abs_path_len, GFP_KERNEL); linux_target = kmalloc(symlinkroot_len + 1 + abs_path_len, GFP_KERNEL);
if (!linux_target) { if (!linux_target) {
rc = -ENOMEM; rc = -ENOMEM;
goto out; goto out;
} }
memcpy(linux_target, cifs_sb->ctx->symlinkroot, symlinkroot_len); memcpy(linux_target, symroot, symlinkroot_len);
linux_target[symlinkroot_len] = '/'; linux_target[symlinkroot_len] = '/';
memcpy(linux_target + symlinkroot_len + 1, abs_path, abs_path_len); memcpy(linux_target + symlinkroot_len + 1, abs_path, abs_path_len);
} else if (smb_target[0] == sep && relative) { } else if (smb_target[0] == sep && relative) {