Re: [PATCH] smb: client: fix OOB reads in cifs_to_posix_acl()

On Tue, Aug 25, 2026 at 11:29 AM Frank Sorenson <[email protected]> wrote:
>
> cifs_to_posix_acl() reads the 6-byte fixed header (version,
> access_entry_count, default_entry_count) before validating
> size_of_data_area, causing an OOB read from truncated responses.
>
> The ACL_TYPE_DEFAULT path then forms a pointer from access_entry_count
> before checking bounds:
>
>         pACE = &cifs_acl->ace_array[count];
>         count = le16_to_cpu(cifs_acl->default_entry_count);
>         size += sizeof(struct cifs_posix_ace) * count;
>         if (size_of_data_area < size)
>                 return -EINVAL;
>
> Validate the header before any field access, validate access ACE count
> before pointer arithmetic in both branches, and validate default ACE
> count before use.
>
> Fixes: bd9684b042dc ("cifs: implement get acl method")
> Cc: [email protected]
> Signed-off-by: Frank Sorenson <[email protected]>
Reviewed-by: Namjae Jeon <[email protected]>
Thanks.