[{"id":3685296,"web_url":"http://patchwork.ozlabs.org/comment/3685296/","msgid":"","list_archive_url":null,"date":"2026-05-02T13:31:38","subject":"Re: [PATCH v2 2/2] smb/client: fix out-of-bounds read in\n symlink_data()","submitter":{"id":510,"url":"http://patchwork.ozlabs.org/api/people/510/","name":"Steve French","email":"smfrench@gmail.com"},"content":"merged into cifs-2.6.git for-next pending additional review and testing\n\nOn Sat, May 2, 2026 at 5:50 AM wrote:\n>\n> From: Zisen Ye \n>\n> Since smb2_check_message() returns success without length validation for\n> the symlink error response, in symlink_data() it is possible for\n> iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\n> only contains the base SMB2 header (64 bytes), accessing\n> err->ErrorContextCount (at offset 66) or err->ByteCount later in\n> symlink_data() will cause an out-of-bounds read.\n>\n> Link: https://lore.kernel.org/linux-cifs/297d8d9b-adf7-42fd-a1c2-5b1f230032bc@chenxiaosong.com/\n> Fixes: 76894f3e2f71 (\"cifs: improve symlink handling for smb2+\")\n> Cc: Stable@vger.kernel.org\n> Signed-off-by: Zisen Ye \n> Reviewed-by: ChenXiaoSong \n> ---\n> fs/smb/client/smb2misc.c | 3 ++-\n> 1 file changed, 2 insertions(+), 1 deletion(-)\n>\n> diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c\n> index 973fce3c959c..2a7355ce1a07 100644\n> --- a/fs/smb/client/smb2misc.c\n> +++ b/fs/smb/client/smb2misc.c\n> @@ -241,7 +241,8 @@ smb2_check_message(char *buf, unsigned int pdu_len, unsigned int len,\n> if (len != calc_len) {\n> /* create failed on symlink */\n> if (command == SMB2_CREATE_HE &&\n> - shdr->Status == STATUS_STOPPED_ON_SYMLINK)\n> + shdr->Status == STATUS_STOPPED_ON_SYMLINK &&\n> + len > calc_len)\n> return 0;\n> /* Windows 7 server returns 24 bytes more */\n> if (calc_len + 24 == len && command == SMB2_OPLOCK_BREAK_HE)\n> --\n> 2.53.0\n>","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","linux-cifs@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=qbkyD7XP;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=linux-cifs+bounces-11358-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"qbkyD7XP\"","smtp.subspace.kernel.org;\n arc=pass smtp.client-ip=209.85.219.45","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com"],"Received":["from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g782p3Cthz1yGq\n\tfor ; Sat, 02 May 2026 23:32:02 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id A460D300407D\n\tfor ; Sat, 2 May 2026 13:31:53 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 93872238C0A;\n\tSat, 2 May 2026 13:31:52 +0000 (UTC)","from mail-qv1-f45.google.com (mail-qv1-f45.google.com\n [209.85.219.45])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id E727E233722\n\tfor ; Sat, 2 May 2026 13:31:50 +0000 (UTC)","by mail-qv1-f45.google.com with SMTP id\n 6a1803df08f44-8acb856a674so36320516d6.0\n for ;\n Sat, 02 May 2026 06:31:50 -0700 (PDT)"],"ARC-Seal":["i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777728712; cv=pass;\n b=iIkopvFjkOHPfRwRSgSX99s/fWvzNjTutiPKRy4/Pa9NAlABTygD8itrDJN6tkr2yhctVNSVmGC0I4ul7beoIIhdaaNHZxuP2sohm62qxrjT+4XjdtP4mPaj0ZD1mF32XlvqHcs8FuajOsoB1EclTTZ3v48CeKUBZm+4Es9j+Gc=","i=1; a=rsa-sha256; t=1777728710; cv=none;\n d=google.com; s=arc-20240605;\n b=hUlA8pf4ow8EDjGQ/PGndvHup/ql4vSq+vO931hWSYKLYwMGKcrw+y51xUx/PRPBWJ\n 9uRVvuCasTvN00OIG2fFidA/MTgMuwd4ghZfSUDFX6UJRnN8tcJZ/IwXivKNlUKUedbo\n ujmI2A4hwUpVFjfjrBEeebFeKQ1aaiWhFdVqBwN8i3txW4HzeOlDhKfRvq3ZgBK5/D4q\n g1DdrKhd7C4dQ97a/C8zPQ0KO7jQ3fZfyK8kOEzOCDzVEv+jw6nEfaC+KoJjt3C+ZjKP\n VB9WMdU/bq40YLX9ZSpp0+/fTg2GjpYEdDtm3iXiW1+V7R4Aqwl3ILnLpNmeFAH4KWk0\n LYIA=="],"ARC-Message-Signature":["i=2; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777728712; c=relaxed/simple;\n\tbh=pgccSiTk7cwpR918eHNO4Vz2jYqp1tuwAppiPbXW6rM=;\n\th=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:\n\t To:Cc:Content-Type;\n b=jwkgGucviQsbCFKsbjlBkRmzYlokwLh4rJNwcu/zrlj54fql9S/zPm3h0awlJ3eFn9ewtPUu+gmWHM1NYXsYD3ArVbsWg56+AS3srx5T08Uy7Vhk+VVa4rylyMEVsruzU0D8odq+BXtlMgBdTKiTcbgAolkWGnKK3v1lHpjBoDs=","i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;\n s=arc-20240605;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:dkim-signature;\n bh=Hrz1mttDC61uI6sTdrN+XNGEUMww2d9RdTsgZTXNbkg=;\n fh=yjngr4Ur65yIztn1No1BGScYpyNFlBDtOVcCWWzCxY4=;\n b=LBzSI6eOKQTr3F7in344amenIH2mvOWl21PVbQjrqaSpVq9sYllih9vOfm0640owNU\n rdKGJAqYq1LL8AsS7yd/MwVU6isbdBAw7WFCJ49v7ubOnL+oKWKLFuPxbwm804+tpbgC\n 3l5Upk9loDD6GdTa3gZKPFKGF1HkNcj+/BW5dsQ7h4dervG1u98Gj3q4kqrGzz+syO5J\n nxPjuwnlyw2vCr3M+Q09vvc0xBhwts3IjjG61VmjoopUVbAGOOVONibfGv4lCzvxO3oE\n BbiwNuORMos5N+82b+zTw14Y5xa6UonbAoALVEOrzkHtjzNx80JiwpUphF3ChrmjoilG\n ZZQA==;\n darn=vger.kernel.org"],"ARC-Authentication-Results":["i=2; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=qbkyD7XP; arc=pass smtp.client-ip=209.85.219.45","i=1; mx.google.com; arc=none"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1777728710; x=1778333510;\n darn=vger.kernel.org;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:from:to:cc:subject:date\n :message-id:reply-to;\n bh=Hrz1mttDC61uI6sTdrN+XNGEUMww2d9RdTsgZTXNbkg=;\n b=qbkyD7XPoCk03zOijwy5/n4SVmcp77/JlJM8lrIxLPPpdLTmH2rwM1OF9gEEEZMBbv\n g5D1srBK8wU0K1qKE4OYTullwdsIB444AuqmH4fmt6MJeeyl9h1a5tETHBBDLpeUf2xq\n woX5gTTSCuxbl+wGpXZc5i383FPqPEXXcwSoBmh4wP8zPM0kFVEeT/415w5rVbw4NEYu\n 9n7CXAWZGHpJJ6ja1fJswQHtkTDLt41I6qcmjyR5z6OaLOZ6ya3N+btz7tR93k/pePv0\n h+/RgR/GUxkcSUNSETLtIUzAfcbYcjCs7+QxkCIa88NjD228NdCnDEDL7xhH0Mj3IR+d\n Q/2A==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777728710; x=1778333510;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=Hrz1mttDC61uI6sTdrN+XNGEUMww2d9RdTsgZTXNbkg=;\n b=d8iCY/6/+hnIxVHkX5yRggvxPqcZb7wTtL8je0GfZ3qqNyF7sgjlhBDj6xCGPGOVfd\n 1PAFBF+5tJ/rJxlxFmsD2sWSLutPP9LXkQk5ugXDKyr72kFFN0TTYzVnk6NwzfFwGwQc\n Kg5IsG/HLfDCq2Ur2qk0FgxhB6vAMuY0F6UogxyjyPH7PvmJxF7CrEnNu43OemPOdmpd\n c1t8bW43TY0QPj709MQpx6hcUcpVuJcYoEV5I8cefbvpin+iRSzMMlhhPh6ZHGDDh8mp\n eNyTmrSIvrFS0l3pO+OJL59nP74h/HdwZpUGTcCOe6OIrcu9+a3T+pgd9v9BIFGgKbG/\n eU/A==","X-Forwarded-Encrypted":"i=1;\n AFNElJ/AQtpcuXvmpdv/+yOeFMFN/l8vN58MZitXgqb3Fw7Iecbk6o9OWP0fNDtSWQM4o7BlrxbZ81/WFPGZ@vger.kernel.org","X-Gm-Message-State":"AOJu0YzxLcEKj/6LPjNjSmbX2JcKaa4Tnk+MjQ/x52SwtGBzmL0iZZbr\n\tRiRoQX8093IF/OSiwnT0YyB6PMtwHfpO5OLHu5DxNExeBNvzFlYMCI8vYdsOOmbJMc5bR3H3DZ3\n\tWYgfz4v8pKv02bMkp9nEcNMw9mpqeCvA=","X-Gm-Gg":"AeBDies6sjTumx7TjTCIgnsUZLAGc14U4v8A+JoyBrD1cjkyImL3Nijpil8/V8fjI+4\n\tWgx51l9WLpwoOu3Jr07mBgtd2EpTh52Xe8rSnXuFeNwo6eUrp4ktHujUXD6UJgxv840kSOGT1DH\n\tcYov2b2LCxq4LM+M+BRh3fseRe8a6qADTTG3L2EnFx8WfwBXirTLkHeY7PqerRtsAQ//O+8SMe7\n\tDnxOIHG0ywiwadsJAlpi+ZAydb93pA9uupuck1LraraK6EsdtH+9cxkJEl1T7r4u0vgJs7XBYS7\n\tVOE1o3AZhdoqfkRcjqOSHzUPGDvKuDhpHSnqmyOIUwpvD1BeM0YSEb/3ZjnVmc8/R/CBv/St3sf\n\tBvBKn+qPCqzCwKrojvngGwTwKggeVv29cFB4AWEfZEBJn07vwAB5E5SZ3Kei6zex/iq8U/eY=","X-Received":"by 2002:a05:6214:4c86:b0:89a:1c81:65a6 with SMTP id\n 6a1803df08f44-8b668732e3fmr40217166d6.17.1777728709600; Sat, 02 May 2026\n 06:31:49 -0700 (PDT)","Precedence":"bulk","X-Mailing-List":"linux-cifs@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","References":"<20260502095435.2969835-1-zisenye@stu.xidian.edu.cn>\n <20260502104836.2980415-1-jasonye247@163.com>","In-Reply-To":"<20260502104836.2980415-1-jasonye247@163.com>","From":"Steve French ","Date":"Sat, 2 May 2026 08:31:38 -0500","X-Gm-Features":"AVHnY4IA2OM7KepiFDCKXPMHG0pkdd0-xitH6I9Qe-pVWSU9I1aM70hKjPNlndg","Message-ID":"\n ","Subject":"Re: [PATCH v2 2/2] smb/client: fix out-of-bounds read in\n symlink_data()","To":"jasonye247@163.com","Cc":"linkinjeon@kernel.org, pc@manguebit.org, ronniesahlberg@gmail.com,\n\tsprasad@microsoft.com, tom@talpey.com, bharathsm@microsoft.com,\n\tsenozhatsky@chromium.org, dhowells@redhat.com, chenxiaosong@chenxiaosong.com,\n\tgregkh@linuxfoundation.org, linux-cifs@vger.kernel.org,\n\tZisen Ye , Stable@vger.kernel.org,\n\tChenXiaoSong ","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable"}}]