Re: [PATCH] ksmbd: fix out-of-bounds read when padding the final compound response

[Namjae Jeon]

On Tue, Oct 27, 2026 at 10:40 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> Compound response handling pads the last response of a compound to an
> 8-byte boundary by growing the final iov and the RFC1002 length.
> smb2_allocate_rsp_buf() allocates exactly response_sz. A command can
> fill the response buffer to within 7 bytes of its end, for example a
> QUERY_INFO whose output is bounded only by the space left. The padding
> can then run past the allocation, and ksmbd_tcp_writev() reads those
> bytes when it sends the response.
>
>   BUG: KASAN: slab-out-of-bounds in _copy_from_iter+0x744/0x10e0
>   Call Trace:
>    _copy_from_iter+0x744/0x10e0
>    tcp_sendmsg_locked+0x2290/0x3f80
>    ksmbd_tcp_writev+0x10c7/0x1ab0 [ksmbd]
>
> Allocate room for the padding when the request is a compound, as
> smb2_read() and smb2_read_pipe() do for their payloads. response_sz is
> unchanged, so commands still fill only up to it, and kvzalloc() zeroes
> the padding.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!