[BUG] ksmbd: OOB read in share_config_request() when payload_sz == 0

[Farhad Alemi]

Hello Namjae and Steve,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/106-ksmbd-oob-read-share_config_request/

  BUG: KASAN: slab-out-of-bounds in strnlen+0x66/0x90 lib/string.c:432
  kstrndup+0x2d/0x160 mm/util.c:120
  share_config_request fs/smb/server/mgmt/share_config.c:168 [inline]
  ksmbd_share_config_get+0x5e0/0x1190
       fs/smb/server/mgmt/share_config.c:243
  smb2_tree_connect+0x2f4/0x1320 fs/smb/server/smb2pdu.c:2015

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,