Re: [PATCH ksmbd-for-next] ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()

[Namjae Jeon]

On Sat, Sep 12, 2026 at 9:09 AM Giorgi Kobakhia <gkobakhi@xxxxxxx> wrote:
>
> When the large dacl_offset is provided, dacl_offset + sizeof(struct
> smb_acl) overflows on 32-bit builds and the check is passed,
> Which makes le16_to_cpu(ppdacl_ptr->size) read out-of-bounds. This
> only happens for dacl_offset in range [0xFFFFFFF8, 0xFFFFFFFF]. So
> the oob read is max 8 bytes preceding the allocated ppntsd.
>
>     unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
>     int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;
>
>     if (!dacl_offset ||
>         (dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
>             goto out;
>
> Commit beff0bc9d69b ("ksmbd: fix overflow in dacloffset bounds check")
> fixes similar checks in other functions. But leaves this one out,
> because it is only valid for 32-bit builds.
>
> Reproduced on 32-bit ARM with KASAN, by a client sending SMB2
> SET_INFO(SEC) with dacloffset=0xfffffff8, then QUERY_INFO(SEC) on the
> same file:
>
>  BUG: KASAN: slab-out-of-bounds in build_sec_desc (fs/smb/server/smbacl.c:1105)
>  Read of size 2 at addr c2a273fa by task kworker/1:1/35
>  CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Not tainted 7.3.0-rc2+ #5
>  Workqueue: ksmbd-io handle_ksmbd_work
>  Call trace:
>   kasan_check_range from build_sec_desc (fs/smb/server/smbacl.c:1105)
>   build_sec_desc from smb2_query_info (fs/smb/server/smb2pdu.c:7676)
>   smb2_query_info from handle_ksmbd_work (fs/smb/server/server.c:160)
>   handle_ksmbd_work from process_one_work (kernel/workqueue.c:3401)
>   process_one_work from worker_thread (kernel/workqueue.c:3473)
>   worker_thread from kthread (kernel/kthread.c:436)
>
> Add overflow check.
>
> Fixes: 8f0541186e9a ("ksmbd: fix heap-based overflow in set_ntacl_dacl()")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM claude
> Tested-by: Xiang Mei <xmei5@xxxxxxx>
> Signed-off-by: Giorgi Kobakhia <gkobakhi@xxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!