Re: [PATCH 0/2] smb: client: validate ACL lengths and compare encoded SIDs

[Paulo Alcantara]

liuyong <pkfxxxing@xxxxxxxxx> writes:

> Hello,
>
> This series fixes two memory-safety issues in the CIFS/SMB3 client,
> reproduced on mainline commit f66469d9905b39d2c260a15d7d6db450f4db67c1:
>
> 1. A zero-length security-query response can bypass the caller's minimum
>    and return ZERO_SIZE_PTR, causing an Oops during an ownership change.
> 2. populate_new_aces() compares variable-length SIDs over the maximum
>    structure size, causing a KASAN out-of-bounds read during chmod.
> ...

Applied with MID_SID_LEN and MIN_SEC_DESC_LEN removed as there were left
unused after patch 1/2.