Re: [PATCH] ksmbd: fix SMB2 CREATE response buffer overflow

[Namjae Jeon]

> +       if (cmd == SMB2_CREATE_HE) {
> +               size_t create_sz;
> +
> +               /*
> +                * A CREATE response may contain any combination of fixed
> +                * response contexts. Account for the 4-byte length field
> +                * because work->response_sz includes it while smb_get_msg()
> +                * skips over it.
> +                */
> +               create_sz = sizeof(__be32) +
> +                           offsetof(struct smb2_create_rsp, Buffer);
> +               create_sz += vals->create_lease_size;
> +               create_sz += max_t(size_t,
> +                                  vals->create_durable_size,
> +                                  vals->create_durable_v2_size);
> +               create_sz += vals->create_mxac_size;
> +               create_sz += vals->create_disk_id_size;
> +               create_sz += vals->create_posix_size;
> +               create_sz += vals->create_aapl_size;
> +               sz = max_t(size_t, sz, create_sz);
Since these sizes are fixed for each SMB dialect, we should avoid
recalculating them for every request. It would be cleaner to define
the required CREATE response size in advance and use that predefined
value during buffer allocation.
Thanks.