Re: [PATCH 1/2] smb/client: fix out-of-bounds read in smb2_compound_op()

[Greg KH <gregkh@linuxfoundation.org>]

On Sat, May 02, 2026 at 04:34:21PM +0800, Zisen Ye wrote:
> If a server sends a truncated response but a large OutputBufferLength, and
> terminates the EA list early, check_wsl_eas() returns success without
> validating that the entire OutputBufferLength fits within iov_len.
> 
> Then smb2_compound_op() does:
>     memcpy(idata->wsl.eas, data[0], size[0]);
> 
> Where size[0] is OutputBufferLength. If iov_len is smaller than size[0],
> memcpy can read beyond the end of the rsp_iov allocation and leak adjacent
> kernel heap memory.
> 
> Link: https://lore.kernel.org/linux-cifs/d998240c-aca9-420d-9dbd-f5ba24af19e0@chenxiaosong.com/
> Signed-off-by: Zisen Ye <zisenye@stu.xidian.edu.cn>
> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
> ---
>  fs/smb/client/smb2inode.c | 3 +++
>  1 file changed, 3 insertions(+)

No Fixes: tag?  No cc: stable?  Do you not want this backported
anywhere?

thanks,

greg k-h