7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Namjae Jeon commit 9fd1fcbbf84986a7bcf601a2b90540899069d263 upstream. A FileLinkInformation request can supply "/" as the new link name. smb2_get_name() strips the trailing slash and passes an empty string to ksmbd_vfs_kern_path_start_removing(). ksmbd_vfs_path_lookup() resolves an empty pathname as the configured share path, without LOOKUP_BENEATH. With ReplaceIfExists set, smb2_create_link() can therefore remove the share root from its parent before link creation fails. An authenticated client with a writable share and DELETE access to a file can trigger this if the share root is empty and the mapped user has write and search permission on its parent directory. Return -EINVAL for empty pathnames when for_remove is set, before resolving the share path or acquiring removal resources. Ordinary lookups continue to accept empty pathnames for opening the share root. Fixes: 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name") Cc: stable@vger.kernel.org Reported-by: Zachariah Mithani (AploSec) Signed-off-by: Namjae Jeon Signed-off-by: Greg Kroah-Hartman --- fs/smb/server/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -61,6 +61,10 @@ static int ksmbd_vfs_path_lookup(struct struct dentry *d; if (pathname[0] == '\0') { + /* The share root must never be removed. */ + if (for_remove) + return -EINVAL; + pathname = share_conf->path; root_share_path = NULL; } else {