Re: [PATCH] smb: client: fix OOB array access in __smb2_calc_size() on unknown Command

The SMB3 protocol often specifies closing the connection on invalid messages, is there some reason you are opting to ignore this field?

Tom.

Aug 21, 2026 10:45:35 AM Frank Sorenson <[email protected]>:

> has_smb2_data_area[] is indexed by the server-supplied shdr->Command
> with no bounds check:
> 
>     if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)
> 
> The array has NUMBER_OF_SMB2_COMMANDS (0x13) entries; any Command value
>> = 0x13 reads past the end into adjacent read-only data.
> 
> Add an upper-bound check before the lookup; commands outside the valid
> range have no data area, so treat them as false.
> 
> Fixes: 093b2bdad322 ("CIFS: Make demultiplex_thread work with SMB2 code")
> Cc: [email protected]
> Signed-off-by: Frank Sorenson <[email protected]>
> ---
> fs/smb/client/smb2misc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
> index 9068175e57cd..26b41ea3b72b 100644
> --- a/fs/smb/client/smb2misc.c
> +++ b/fs/smb/client/smb2misc.c
> @@ -451,7 +451,8 @@ __smb2_calc_size(void *buf, bool *have_data, bool *data_area_overlap)
>      */
>     len += le16_to_cpu(pdu->StructureSize2);
> 
> -   if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)
> +   if (le16_to_cpu(shdr->Command) >= ARRAY_SIZE(has_smb2_data_area) ||
> +       !has_smb2_data_area[le16_to_cpu(shdr->Command)])
>         goto calc_size_exit;
> 
>     smb2_get_data_area_len(&offset, &data_length, shdr);
> -- 
> 2.55.0