Re: [PATCH 1/2] smb: client: fix off-by-8 bounds check in check_wsl_eas()

ChenXiaoSong
2026-04-08T05:59:32Z

The for loop does not seem to catch cases where `outlen` is excessively
large. In such cases, smb2_compound_op() would use this large `outlen`
to `memcpy()`, which could lead to OOB.

```
smb2_compound_op()
{
...
size[0] = outlen; // very large
check_wsl_eas()
memcpy(..., outlen) // out-of-bounds
...
}
```

On 4/8/26 13:39, Greg Kroah-Hartman wrote:
> On Wed, Apr 08, 2026 at 10:51:12AM +0800, ChenXiaoSong wrote:
>> Sashiko reported another out-of-bounds issue:
>> https://sashiko.dev/#/patchset/2026040635-banking-unsoiled-3250@gregkh
>>
>> Should we add the following checks in check_wsl_eas()?
>>
>> ```
>> --- a/fs/smb/client/smb2inode.c
>> +++ b/fs/smb/client/smb2inode.c
>> @@ -121,6 +121,9 @@ static int check_wsl_eas(struct kvec *rsp_iov)
>> ea = (void *)((u8 *)rsp_iov->iov_base +
>> le16_to_cpu(rsp->OutputBufferOffset));
>> end = (u8 *)rsp_iov->iov_base + rsp_iov->iov_len;
>> + if (ea + outlen > end)
>> + return -EINVAL;
>
> Then you would miss any "first" structures here, as I think the for loop
> catches this later on with the line:
>
>
>> +
>> for (;;) {
>> if ((u8 *)ea > end - sizeof(*ea))
>> return -EINVAL;
>
> That one, right?
>
> Or am I misreading this?
>
> Pointer math is "fun" :(
>
> thanks,
>
> greg k-h

--
ChenXiaoSong <chenxiaosong@kylinos.cn>
Chinese Homepage: chenxiaosong.com
English Homepage: chenxiaosong.com/en