NACK/Cmnt: [SRU][J][PATCH 0/1] CVE-2025-37956

[Edoardo Canepa]

Rejected for the following reasons:

Jammy lacks 1cdeca6a7264, so smb2_get_name() has no leading-slash
check, and the new "*name == '\0'" test runs before
ksmbd_conv_path_to_unix() and ksmbd_strip_last_slash() - the two calls
that can create an empty string, being strreplace(path, '\\', '/') and
a strip of every trailing slash.
So a rename with newname "\" passes set_rename_info() and the new
guard, becomes "/" then "", and still reaches ksmbd_vfs_rename() with
an empty path, where link_path_walk() returns 0 without setting
nd->last and lookup_one_qstr_excl() ends up in d_alloc() with an
uninitialised qstr - the very oops being fixed.
Please move the check below those two calls so it tests the string
actually returned; that also covers a plain "/", which the upstream
commit still lets through, and leaves no regression surface.

On 9/10/26 06:17, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-37956
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ksmbd: prevent rename with empty string
>
> Client can send empty newname string to ksmbd server. It will cause a kernel
> oops from d_alloc. This patch return the error when attempting to rename a file
> or directory with an empty new name string.
>
> [ Fix ]
>
> jammy/linux: backported from 53e3e5babc09
>
> The upstream fix adds a check that rejects a rename request whose new name is
> an empty string, returning an error instead of proceeding into d_alloc. In the
> jammy tree the affected file is fs/ksmbd/smb2pdu.c (renamed to
> fs/smb/server/smb2pdu.c upstream). This tree's smb2_get_name does not carry the
> leading-slash check that appears as context in the upstream commit, so only the
> empty-string ('\0') guard was applied.
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> A bad fix would primarily affect systems that enable the in-kernel SMB server
> (ksmbd) and export shares to SMB clients, where a regression could cause
> otherwise valid rename operations to fail. Systems that do not load or use the
> ksmbd module are not affected by this change.
>
> [ Other Info ]
>
> Kybele flow-v11-25-ga27c0fa6. Reference: d7e893b7/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/deda3eaa/attachment.sig>