Re: [PATCH] smb: client: reject a tree connect response whose byte count is too small

[Namjae Jeon]

On Wed, Jul 29, 2026 at 3:12 AM Bryam Vargas via B4 Relay
<devnull+hexlabsecurity.proton.me@xxxxxxxxxx> wrote:
>
> From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
Hi Bryam,
>
> CIFSTCon() bounds its strnlen() over the byte area with the server's
> ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
> and converts to a huge size_t.  The later subtraction then wraps __u16
> bytes_left, and that is what bounds cifs_strndup_from_utf16().
>
> pByteArea() scales with the response's WordCount, also server-chosen, so
> the walk can start past everything the request itself wrote, of which
> cifs_buf_get() clears only the first 67 bytes.  KMSAN reports the read of
> uninitialised heap, and the bytes reach userspace through
> tcon->nativeFileSystem in /proc/fs/cifs/DebugData.
>
> Reject a byte area too small for what the parser consumes.  A response
> carrying a service string has at least two bytes there, so nothing valid
> is rejected, and both subtractions are then safe.
>
> Fixes: cc20c031bb06 ("cifs: convert CIFSTCon to use new unicode helper functions")
> Cc: stable@xxxxxxxxxx
> Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
Can you check the build warning that was reported by the kernel test robot ?

All warnings (new ones prefixed by >>):

>> fs/smb/client/cifssmb.c:1791:19: warning: implicit conversion from 'int' to 'enum smb_eio_trace' changes value from 128 to -128 [-Wconstant-conversion]
    1791 |                         return smb_EIO(smb_eio_trace_write_too_far);
         |                                ~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/smb/client/cifssmb.c:1982:17: warning: implicit conversion from
'int' to 'enum smb_eio_trace' changes value from 128 to -128
[-Wconstant-conversion]
    1982 |                         rc = smb_EIO(smb_eio_trace_write_too_far);
         |                              ~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/smb/client/cifssmb.c:2074:19: warning: implicit conversion from
'int' to 'enum smb_eio_trace' changes value from 128 to -128
[-Wconstant-conversion]
    2074 |                         return smb_EIO(smb_eio_trace_write_too_far);
         |                                ~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   3 warnings generated.