Re: [PATCH] smb: client: fix OOB array access in __smb2_calc_size() on unknown Command

On 8/21/26 12:08 PM, Tom Talpey wrote:
> The SMB3 protocol often specifies closing the connection on invalid messages, is there some reason you are opting to ignore this field?
>
> Tom.

Examining the paths into __smb2_calc_size() more closely, I don't see a 
call path that feeds an unvalidated Command into __smb2_calc_size(); 
either smb2_check_message() pre-validates it (and tears down the 
connection as you expected), or the caller is operating on already-known 
data.

So at this point, the OOB is unreachable, and this patch is unnecessary.

My apologies; this patch should be disregarded.


Frank


> Aug 21, 2026 10:45:35 AM Frank Sorenson <[email protected]>:
>
>> has_smb2_data_area[] is indexed by the server-supplied shdr->Command
>> with no bounds check:
>>
>>      if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)
>>
>> The array has NUMBER_OF_SMB2_COMMANDS (0x13) entries; any Command value
>>> = 0x13 reads past the end into adjacent read-only data.
>> Add an upper-bound check before the lookup; commands outside the valid
>> range have no data area, so treat them as false.
>>
>> Fixes: 093b2bdad322 ("CIFS: Make demultiplex_thread work with SMB2 code")
>> Cc: [email protected]
>> Signed-off-by: Frank Sorenson <[email protected]>
>> ---
>> fs/smb/client/smb2misc.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
>> index 9068175e57cd..26b41ea3b72b 100644
>> --- a/fs/smb/client/smb2misc.c
>> +++ b/fs/smb/client/smb2misc.c
>> @@ -451,7 +451,8 @@ __smb2_calc_size(void *buf, bool *have_data, bool *data_area_overlap)
>>       */
>>      len += le16_to_cpu(pdu->StructureSize2);
>>
>> -   if (has_smb2_data_area[le16_to_cpu(shdr->Command)] == false)
>> +   if (le16_to_cpu(shdr->Command) >= ARRAY_SIZE(has_smb2_data_area) ||
>> +       !has_smb2_data_area[le16_to_cpu(shdr->Command)])
>>          goto calc_size_exit;
>>
>>      smb2_get_data_area_len(&offset, &data_length, shdr);
>> -- 
>> 2.55.0

-- 
Frank Sorenson
[email protected]
Principal Software Maintenance Engineer, filesystems
Red Hat