Re: [PATCH] ksmbd: fix SMB2 CREATE response buffer overflow in compound requests

[Namjae Jeon]

On Tue, Oct 27, 2026 at 10:30 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> A CREATE response that carries an AAPL create context can reach
> create_rsp_size (572 bytes for SMB 3.1.1). Commit 713c31a3a225
> ("ksmbd: fix SMB2 CREATE response buffer overflow") makes
> smb2_allocate_rsp_buf() reserve that much, but only for the first
> command of a compound. A CREATE later in the compound is guarded by
> is_chained_smb2_message() instead, which reserves only
> MAX_CIFS_SMALL_BUFFER_SIZE (448 bytes) for the next response. smb2_open()
> then appends the create contexts without checking the space left.
>
> That check also uses the unpadded length of the response so far.
> init_chained_smb2_rsp() pads the previous response to 8 bytes before the
> next command runs, so the next response can start up to 7 bytes later
> than the check assumes.
>
> When a CREATE follows a command that fills the response buffer, such as
> QUERY_DIRECTORY, it writes its create contexts past the end of the
> buffer. The AAPL context is written last.
>
>   BUG: KASAN: slab-out-of-bounds in create_aapl_rsp_buf+0x31/0x6e0 [ksmbd]
>   Call Trace:
>    create_aapl_rsp_buf+0x31/0x6e0 [ksmbd]
>    smb2_open+0x4fa8/0xd900 [ksmbd]
>    handle_ksmbd_work+0x88c/0x1cb0 [ksmbd]
>
> When the next command is a CREATE, reserve create_rsp_size, as
> smb2_allocate_rsp_buf() does for a single CREATE, and check the reserve
> against the 8-byte aligned offset where the next response starts.
>
> Fixes: 8f1b796ff113 ("ksmbd: add AAPL kAAPL_SERVER_QUERY create context support")
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!