[PATCH v2] smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()

[Diego Oliva]

On Mon, Aug 31, 2026 at 11:15 PM Paulo Alcantara <pc at manguebit.org> wrote:

> Shouldn't you also validate the minimum response size so that you can
> safely dereference the above fields?  E.g.,
>
> if (rsp_iov.iov_len < tcon->ses->server->read_rsp_size) {
>         rc = smb_EIO(...);
>         *nbytes = 0;
> } else {
>         unsigned int data_length = le16_to_cpu(pSMBr->DataLengthHigh);
>         ...
> }

I've reproduced the scenario you referenced and confirmed an
additional check is needed.

> @data_length is now unsigned, so use '%u' instead.  Also, print __func__
> in cifs_dbg().

Will do.

Thanks for your time!