Re: [BUG] ksmbd: OOB read in share_config_request() when payload_sz == 0

[Farhad Alemi]

On Thu, Aug 27, 2026 at 7:36 PM Namjae Jeon <linkinjeon@xxxxxxxxxx> wrote:
>
> On Fri, Aug 28, 2026 at 7:38 AM Farhad Alemi <farhad.alemi@xxxxxxxxxxxx> wrote:
> >
> > Hello Namjae and Steve,
> >
> > While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> > SEFCOM lab, we hit the crash below. Crash reports can be found here:
> >
> >   https://github.com/farhad-alemi/public_bug_reports/tree/main/106-ksmbd-oob-read-share_config_request/
> >
> >   BUG: KASAN: slab-out-of-bounds in strnlen+0x66/0x90 lib/string.c:432
> >   kstrndup+0x2d/0x160 mm/util.c:120
> >   share_config_request fs/smb/server/mgmt/share_config.c:168 [inline]
> >   ksmbd_share_config_get+0x5e0/0x1190
> >        fs/smb/server/mgmt/share_config.c:243
> >   smb2_tree_connect+0x2f4/0x1320 fs/smb/server/smb2pdu.c:2015
> >
> > Our reproducer.c is available upon request.
> >
> > Happy to test a patch if that would help.
> Can you test if the attached patch fixes this issue?
>
> Thanks.

Tested on 388b607d107c07aaade04c7f22f344cab6bdccd3 built w
UpstreamAppArmorKASAN.config; patched version no longer panics.
Thanks!