Re: [PATCH 1/3] ksmbd: cap response sizes in ipc_validate_msg()

[Michael Bommarito <michael.bommarito@gmail.com>]

On Wed, Apr 15, 2026 at 11:00:58AM +0900, Namjae Jeon wrote:
> However, on the userspace side (ksmbd-tools/mountd/rpc.c), the DCE/RPC
> response builder (try_realloc_payload() and ndr_write_bytes())
> dynamically grows the payload by 4096 bytes using g_try_realloc() when
> preparing responses for calls such as NetShareEnumAll, etc..
> This can cause share enumeration failures on servers with many shares.

OK, thanks for explaining.  Sorry for missing that context.  If you
are OK with it, I will send a v2 that drops the cap on RPC_REQUEST
and SHARE_CONFIG_REQUEST and uses check_add_overflow() to just
prevent msg_sz from wrapping.  The [0, NGROUPS_MAX] bound stays on
LOGIN_REQUEST_EXT.

> You don't add the check for KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST case.
> We don't need to check resp->session_key_len and resp->spnego_blob_len?

They're both __u16 so the sum can't wrap the unsigned int msg_sz,
which is why I skipped them.  Happy to add check_add_overflow() there
too for symmetry and clarity in case anyone refactors.  Just let me
know which you prefer.

Thanks,
Mike