Re: [PATCH] smb: client: fix OOB pointer arithmetic in cifs_to_posix_acl()

On 8/24/26 7:59 PM, Namjae Jeon wrote:
> On Tue, Aug 25, 2026 at 8:10 AM Frank Sorenson <[email protected]> wrote:
>> In the ACL_TYPE_DEFAULT branch, cifs_to_posix_acl() forms a pointer
>> from the server-supplied access_entry_count before the size check that
>> bounds it:
> There seems to be still oob issue in this function although this patch
> is applied.
> Should we also validate acl header before accessing ->version ?
>
> +        if (size_of_data_area < sizeof(*cifs_acl))
> +              return -EINVAL;
>
>          if (le16_to_cpu(cifs_acl->version) != CIFS_ACL_VERSION)
>                  return -EOPNOTSUPP;

Ah, you are correct.  I'll respin with all the necessary validation.


Frank

>>          pACE = &cifs_acl->ace_array[count];     /* count = access_entry_count */
>>          count = le16_to_cpu(cifs_acl->default_entry_count);
>>          size += sizeof(struct cifs_posix_ace) * count;
>>          if (size_of_data_area < size)           /* too late */
>>                  return -EINVAL;
>>
>> The pointer arithmetic is undefined behaviour before any bounds check.
>>
>> Add an access-ACE size check before the pointer computation, matching
>> the existing guard in the ACL_TYPE_ACCESS path.

-- 
Frank Sorenson
[email protected]
Principal Software Maintenance Engineer, filesystems
Red Hat