[PATCH] smb: client: fix heap overflow in DACL owner/group rewrite

[Namjae Jeon]

> @@ -1815,11 +1815,13 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,
>                                 cifs_put_tlink(tlink);
>                                 return rc;
>                         }
> -                       if (mode_from_sid)
> -                               nsecdesclen +=
> -                                       le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace);
> -                       else /* cifsacl */
> -                               nsecdesclen += le16_to_cpu(dacl_ptr->size);
> +                       /*
> +                        * Worst case: every ACE is rewritten with a new SID of
> +                        * SID_MAX_SUB_AUTHORITIES sub-auths -> sizeof(smb_ace) each,
> +                        * plus the smb_acl header replace_sids_and_copy_aces() emits.
Since you mentioned replace_sids_and_copy_aces(), please check whether
replace_sids_and_copy_aces() also has a potential overflow issue.

So for this patch,
Reviewed-by: Namjae Jeon <linkinjeon at kernel.org>

Plus, there is a checkpatch warning from this patch.
WARNING: Unknown commit id '5c3564852c58', maybe rebased or not pulled?
#78:
Fixes: 5c3564852c58 ("cifs: Minimize the number of cifs_acl memory allocations")
total: 0 errors, 1 warnings, 18 lines checked

Thanks.