Bug in Samba's implementation of FSCTL_QUERY_ALLOCATED_RANGES?

[David Disseldorp]

Thanks for the follow up ping...

On Thu, 22 Aug 2024 23:26:00 +0100, David Howells wrote:

> >         if (out_output->length > in_max_output) {
> >                 DEBUG(2, ("QAR output len %lu exceeds max %lu\n",
> >                           (unsigned long)out_output->length,
> >                           (unsigned long)in_max_output));
> >                 data_blob_free(out_output);
> >                 return NT_STATUS_BUFFER_TOO_SMALL;
> >         }
> > 
> > I'm guessing in this case we need to just truncate out_output->length
> > to in_max_output and return STATUS_BUFFER_OVERFLOW.  
> 
> Do you perchance have a fix for this?  I'm seeing it cause failures in
> xfstests when running against cifs connected to samba.

I've proposed a fix via
https://gitlab.com/samba-team/samba/-/merge_requests/3775

If you want to try it yourself...

The following changes since commit b0996ed589a931902a304237d6c03efce2b16f6b:

  s3:tests: Fix spelling error (2024-08-22 10:38:09 +0000)

are available in the Git repository at:

  https://gitlab.com/ddiss/samba.git qar_rsp_truncation

for you to fetch changes up to 3c034c4d177ea2367b3131f813381d91c98ab7e1:

  s4:torture/smb2: test FSCTL_QUERY_ALLOCATED_RANGES truncation (2024-08-23 13:06:04 +0000)

----------------------------------------------------------------
David Disseldorp (2):
      smb2_ioctl: truncate FSCTL_QUERY_ALLOCATED_RANGES responses
      s4:torture/smb2: test FSCTL_QUERY_ALLOCATED_RANGES truncation

 source3/smbd/smb2_ioctl.c         |   4 +-
 source3/smbd/smb2_ioctl_filesys.c |  54 ++++++++------
 source4/libcli/smb2/ioctl.c       |   3 +-
 source4/torture/smb2/ioctl.c      | 150 +++++++++++++++++++++++++++++++++++++-
 4 files changed, 187 insertions(+), 24 deletions(-)