[PATCH v3 0/2] smb: client: fix out-of-bounds reads in CIFSSMBRead()

[Diego Oliva <diego@bynar.io>]

CIFSSMBRead() parses the server's READ_RSP without validating either
the length of the response or the DataOffset it carries. A malicious
or compromised SMB1 server can exploit either to read past the end of
the receive buffer, leaking adjacent kernel heap into the caller's
read buffer or oopsing on unmapped memory. SMB1 is not negotiated by
default; reaching this code requires an explicit vers=1.0 mount.

Patch 1 rejects responses too short to contain a whole READ_RSP, so
the header fields can be dereferenced safely. Patch 2 ejects a
DataOffset/DataLength pair that falls outside the received response.

Both patches use smb_EIO2(), introduced in v6.19, so they do not apply
to older stable trees as-is. Anyone who wants them in an older tree
only needs to return plain -EIO in place of smb_EIO2().

v3:
 - split into two patches; validate the minimum response size before
   dereferencing the READ_RSP header fields (Paulo Alcantara)
 - print data_length with %u and add __func__ to cifs_dbg() calls
   (Paulo Alcantara)
 - rebased on current upstream
 - v2: https://lore.kernel.org/linux-cifs/20260831125045.479576-1-diego@bynar.io/

v2:
 - make data_length unsigned, as suggested by Namjae Jeon
 - v1: https://lore.kernel.org/linux-cifs/20260828150203.1419003-1-diego@bynar.io/

Diego Oliva (2):
  smb: client: reject short READ responses in CIFSSMBRead()
  smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()

 fs/smb/client/cifssmb.c | 25 ++++++++++++++++++++-----
 fs/smb/client/trace.h   |  1 +
 2 files changed, 21 insertions(+), 5 deletions(-)


base-commit: 89a312991dc6e638a36adc43ccb91dbc25504c04
-- 
2.39.5