[PATCH v3 0/2] smb: client: fix out-of-bounds reads in CIFSSMBRead()

[Paulo Alcantara]

Diego Oliva <diego at bynar.io> writes:

> On Wed, Sep 2, 2026 at 11:32 PM Paulo Alcantara <pc at manguebit.org> wrote:
>>
>> Diego, do you want me to fold this in:
>>
>> diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
>> index f3cba16f6e17..f9aff0712794 100644
>> --- a/fs/smb/client/cifssmb.c
>> +++ b/fs/smb/client/cifssmb.c
>> @@ -1742,7 +1742,8 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms,
>>                         rc = smb_EIO2(smb_eio_trace_read_overlarge,
>>                                       data_length, count);
>>                         *nbytes = 0;
>> -               } else if ((size_t)data_offset + data_length > rsp_iov.iov_len) {
>> +               } else if (data_offset < sizeof(*pSMBr) ||
>> +                          (size_t)data_offset + data_length > rsp_iov.iov_len) {
>>                         /* check that the data lies within the received response */
>>                         cifs_dbg(FYI, "%s: bad data offset %u length %u for response of %zu\n",
>>                                  __func__, data_offset, data_length, rsp_iov.iov_len);
>
> Looks good to me, thanks Paulo!

Done, thanks.  Updated #cifs-next with it.