Re: [PATCH] smb/client: fix possible infinite loop and oob read in symlink_data()

[yebin <yebin@huaweicloud.com>]

Hi Steve,
I have simplified the patch according to the review comments from Sashiko
and sent the V2 version. Please pay attention to it.


On 2026/5/14 1:58, Steve French wrote:
> merged into cifs-2.6.git for-next
>
> On Wed, May 13, 2026 at 3:15 AM Ye Bin <yebin10@huawei.com> wrote:
>>
>> On 32-bit architectures, the infinite loop is as follows:
>>
>>    len = p->ErrorDataLength == 0xfffffff8
>>    u8 *next = p->ErrorContextData + len
>>    next == p
>>
>> On 32-bit architectures, the out-of-bounds read is as follows:
>>
>>    len = p->ErrorDataLength == 0xfffffff0
>>    u8 *next = p->ErrorContextData + len
>>    next == (u8 *)p - 8
>>
>> Reported-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
>> Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Ye Bin <yebin10@huawei.com>
>> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
>> ---
>>   fs/smb/client/smb2file.c | 7 +++++--
>>   1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c
>> index b292aa94a593..9d6f342b3f82 100644
>> --- a/fs/smb/client/smb2file.c
>> +++ b/fs/smb/client/smb2file.c
>> @@ -31,7 +31,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
>>          u32 len;
>>
>>          if (err->ErrorContextCount) {
>> -               struct smb2_error_context_rsp *p;
>> +               struct smb2_error_context_rsp *p, *next;
>>
>>                  len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp,
>>                                                                ErrorContextData) +
>> @@ -49,7 +49,10 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
>>                                   __func__, le32_to_cpu(p->ErrorId));
>>
>>                          len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
>> -                       p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
>> +                       next = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
>> +                       if (next <= p)
>> +                               return ERR_PTR(-EINVAL);
>> +                       p = next;
>>                  }
>>          } else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&
>>                     iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) {
>> --
>> 2.34.1
>>
>>
>
>