Re: [PATCH v2] ksmbd: fix SMB2 CREATE response buffer overflow

[Namjae Jeon]

On Mon, Sep 21, 2026 at 3:15 AM Jérémy Jean
<Jeremy.Jean@xxxxxxxxxxxxxxxxx> wrote:
>
> smb2_allocate_rsp_buf() uses the MAX_CIFS_SMALL_BUFFER_SIZE
> (448-byte) buffer for a single SMB2_CREATE response. That buffer also
> holds a 4-byte length field, which only leaves 444 bytes for the SMB2
> body.
>
> The AAPL response made this buffer too small. After 8f1b796ff113, a
> request with AAPL response contexts may need at least 456 bytes. In
> the 456-byte case, create_aapl_rsp_buf() is appended last, clears 128
> bytes, and writes 12 bytes past the allocation.
>
> KASAN reports:
>
>     BUG: KASAN: slab-out-of-bounds in create_aapl_rsp_buf+0x31/0x6e0
>     Write of size 128 at addr ffff88800370954c by task kworker/0:0/9
>     ...
>     create_aapl_rsp_buf+0x31/0x6e0
>     smb2_open+0x58f9/0xef10
>     ...
>     smb2_allocate_rsp_buf+0x19d/0x370
>     ...
>     The buggy address is located 332 bytes inside of
>      allocated 448-byte region [ffff888003709400, ffff8880037095c0)
>
> Reserve enough space for any fixed CREATE response KSMBD can build.
> Store the required allocation size in the per-dialect values table.
> This keeps the small buffer for other commands and avoids using the max
> transaction buffer for every CREATE.
>
> Fixes: 8f1b796ff113 ("ksmbd: add AAPL kAAPL_SERVER_QUERY create context support")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!