[PATCH v3 0/2] smb: client: fix out-of-bounds reads in CIFSSMBRead()

[Diego Oliva]

On Wed, Sep 2, 2026 at 10:29 PM Frank Sorenson <sorenson at redhat.com> wrote:
>
> Your patch 2 checks that data_offset + data_length fit:
>
> +               } else if ((size_t)data_offset + data_length > rsp_iov.iov_len) {
>
> but I think you may also need a lower-bound check to make sure
> data_offset is at least sizeof(READ_RSP):
>
> +               } else if (data_offset < sizeof(READ_RSP)) {
>
> otherwise, the data would overlap the response header itself.

Hi Frank, that's true, thanks for spotting the missing check!

On Wed, Sep 2, 2026 at 11:32 PM Paulo Alcantara <pc at manguebit.org> wrote:
>
> Diego, do you want me to fold this in:
>
> diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
> index f3cba16f6e17..f9aff0712794 100644
> --- a/fs/smb/client/cifssmb.c
> +++ b/fs/smb/client/cifssmb.c
> @@ -1742,7 +1742,8 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms,
>                         rc = smb_EIO2(smb_eio_trace_read_overlarge,
>                                       data_length, count);
>                         *nbytes = 0;
> -               } else if ((size_t)data_offset + data_length > rsp_iov.iov_len) {
> +               } else if (data_offset < sizeof(*pSMBr) ||
> +                          (size_t)data_offset + data_length > rsp_iov.iov_len) {
>                         /* check that the data lies within the received response */
>                         cifs_dbg(FYI, "%s: bad data offset %u length %u for response of %zu\n",
>                                  __func__, data_offset, data_length, rsp_iov.iov_len);

Looks good to me, thanks Paulo!