[PATCH] smb: client: fix OOB pointer arithmetic in cifs_to_posix_acl()

In the ACL_TYPE_DEFAULT branch, cifs_to_posix_acl() forms a pointer
from the server-supplied access_entry_count before the size check that
bounds it:

        pACE = &cifs_acl->ace_array[count];     /* count = access_entry_count */
        count = le16_to_cpu(cifs_acl->default_entry_count);
        size += sizeof(struct cifs_posix_ace) * count;
        if (size_of_data_area < size)           /* too late */
                return -EINVAL;

The pointer arithmetic is undefined behaviour before any bounds check.

Add an access-ACE size check before the pointer computation, matching
the existing guard in the ACL_TYPE_ACCESS path.

Fixes: bd9684b042dc ("cifs: implement get acl method")
Cc: [email protected]
Signed-off-by: Frank Sorenson <[email protected]>
---
 fs/smb/client/cifssmb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index f5aad5f61dce..fdcdebba8b69 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -3345,6 +3345,9 @@ static int cifs_to_posix_acl(struct posix_acl **acl, char *src,
 		count = le16_to_cpu(cifs_acl->access_entry_count);
 		size = sizeof(struct cifs_posix_acl);
 		size += sizeof(struct cifs_posix_ace) * count;
+		/* validate access ACE count before pointer arithmetic */
+		if (size_of_data_area < size)
+			return -EINVAL;
 		/* skip past access ACEs to get to default ACEs */
 		pACE = &cifs_acl->ace_array[count];
 		count = le16_to_cpu(cifs_acl->default_entry_count);
-- 
2.55.0