[PATCH v3 0/2] smb: client: fix DACL rewrite overflows

[Bjoern Doebel <doebel@amazon.de>]

Two overflow fixes in the CIFS DACL owner/group rewrite path:

1. Patch 1 fixes a heap overflow when copying ACEs whose total size
   exceeds what kmalloc() allocated. The allocation used the old
   (pre-rewrite) ACE count, but the copy loop iterated over the new
   count.

2. Patch 2 fixes a u16 accumulator overflow in the size calculation
   that could wrap around for DACLs with 800+ ACEs, causing the
   check in patch 1 to pass despite the actual size exceeding 64KB.
   Returns -EOVERFLOW when this would occur.

Changes since v2:
- Patch 1 unchanged (already Reviewed-by Namjae Jeon)
- Patch 2: widened nsize from u16 to u32 and added explicit overflow
  guard instead of relying on check_add_overflow (which gcc optimized
  away for a u16 accumulator)
- Patch 2: fixed build_sec_desc() to propagate error from set_chmod_dacl()
  when it fails (discovered during testing)

Bjoern Doebel (2):
  smb: client: fix heap overflow in DACL owner/group rewrite
  smb: client: fail DACL rewrite when the new DACL exceeds 64K

 fs/smb/client/cifsacl.c | 51 ++++++++++++++++++++++++++---------------
 1 file changed, 33 insertions(+), 18 deletions(-)

-- 
2.50.1