[PATCH] smb: client: fix heap overflow in DACL owner/group rewrite

[Bjoern Doebel]

Hi Namjae,

On Sat, Sep 05, 2026 at 10:15:37AM +0900, Namjae Jeon wrote:
> > @@ -1815,11 +1815,13 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,
> >                                 cifs_put_tlink(tlink);
> >                                 return rc;
> >                         }
> > -                       if (mode_from_sid)
> > -                               nsecdesclen +=
> > -                                       le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace);
> > -                       else /* cifsacl */
> > -                               nsecdesclen += le16_to_cpu(dacl_ptr->size);
> > +                       /*
> > +                        * Worst case: every ACE is rewritten with a new SID of
> > +                        * SID_MAX_SUB_AUTHORITIES sub-auths -> sizeof(smb_ace) each,
> > +                        * plus the smb_acl header replace_sids_and_copy_aces() emits.
> Since you mentioned replace_sids_and_copy_aces(), please check whether
> replace_sids_and_copy_aces() also has a potential overflow issue.

That looks sensible. I'll send a followup v3 (the original patch also
needs an update to the Fixes: tag, as you point out.)

Bjoern